Question about Windows 11

[arnold12]

Hello Dear Team,

ist MB Anti-Exploit comptaible with Windows 11?

Using Malwarebytes Anti-Exploit 1.13 Build 430 released - Jan 11, 2022 on a WIndows 11 home with a Standard User account the logs are always empty.

On Windows 10 Logs get filled with protected programs...

Thank you

[Arthi]

Hi arnold12,

Thanks for posting.

1. In the settings menu, can you please turn on "Enable Debug logging". 

2. Open and close a few of the applications that you normally use - MS Office, browsers etc.

3. Zip the contents of the folder C:\ProgramData\Malwarebytes Anti-Exploit and upload it here.

Thank you.

 

[arnold12]

Everything is grayed out on a stadard user account. I can not change it. I am not using a Admin account and there is no option in the software that start a UAC Prompt to change setting

Hare Krishna

[nukecad]

21 hours ago, arnold12 said:

Everything is grayed out on a stadard user account. I can not change it. I am not using a Admin account and there is no option in the software that start a UAC Prompt to change setting

Try the following:

• Right click on the MBAE icon in the System Tray and 'Stop Protection'.
• Open File Explorer and browse to- C:\Program Files (x86)\Malwarebytes Anti-Exploit
  (Or wherever your Mbae is installed).
• Right click on 'mbae.exe' and select 'Run as Administrator'.

That will give you the UAC prompt (at least it does on my Win 10 machine).

• After accepting the UAC, Right click the tray icon again and 'Start Protection'.

You should then be able to change the settings and gather the logs that Arthi has asked for.

(TBH It still works for me if I do it without the 'Stop Protection'/Start Protection' steps, but I'd use them anyway).

Edited February 2, 2022 by nukecad

[arnold12]

Hello, Thank for the support.

I was only able to get the settings activated by uninstalling the app and then reinstalling it, because right after installing it the tray icon is started with admin rights.

Then I enabled debug logs and started Edge and Firefox to browse the net, but still nothing:

 

Malwarebytes Anti-Exploit.zip

[arnold12]

I ran the test file and the MB Anti-Exploit shield detected the exploit attempt when the program was run in admin user right right after installation.

In my opinion the problem is that when MB Anti Exploit starts via auto start on a standard user account is does not show a UAC Prompt to grant it administrator rights

[nukecad]

Dunno, you have to remember that Mbae is now a beta testing tool for the anti-exploit in the main Malwarbytes 4 app (if you install/run the MB4 app real time it will uninstall Mbae) so maybe it's now assumed that those still running Mbae beta will be advanced users and be using admin accounts?

Edited February 2, 2022 by nukecad

[Arthi]

7 hours ago, arnold12 said:

Hello, Thank for the support.

I was only able to get the settings activated by uninstalling the app and then reinstalling it, because right after installing it the tray icon is started with admin rights.

Then I enabled debug logs and started Edge and Firefox to browse the net, but still nothing:

 

Malwarebytes Anti-Exploit.zip 2.69 MB · 0 downloads

Hi Arnold, can you please turn ON "Log protection events", it is right above the Enable debug logging checkbox. Thanks.

[Arthi]

Hi Arnold,

Thanks for reporting this to us. We were just able to reproduce this on our end, the next release should fix it. Apologize for the inconvenience. Thanks.

[arnold12]

16 hours ago, nukecad said:

Dunno, you have to remember that Mbae is now a beta testing tool for the anti-exploit in the main Malwarbytes 4 app (if you install/run the MB4 app real time it will uninstall Mbae) so maybe it's now assumed that those still running Mbae beta will be advanced users and be using admin accounts?

Using standard accounts is less advanced. You would never want to run your ordinary program like web browsers with admin right for security reasons. That's standard in Linux system. only root(admin) account has full privileges to change computer settings

I tried the MB Test Tool and it detected the exploit attempt. seems to be working despite not showing anything in the logs.

[arnold12]

12 hours ago, Arthi said:

Hi Arnold,

Thanks for reporting this to us. We were just able to reproduce this on our end, the next release should fix it. Apologize for the inconvenience. Thanks.

Thank you!

 

[nukecad]

On 2/3/2022 at 10:08 AM, arnold12 said:

Using standard accounts is less advanced. You would never want to run your ordinary program like web browsers with admin right for security reasons. T

Agreed - but MBAE is now a beta testing application, so probably not realy an 'ordinary programme' that a standard user should be changing settings in.

Good to hear it does seem to be working for you, hopefully turning on 'Log Protection Events' is now giving you logs?

(Interesting as I was typing that both my MBAE and Windows Security icons disappeared from my system tray - investigation time. EDIT: Both icons came back on a restart, malware scans clean. Checking further it seems to have been a Defender definition update that removed both the icons?)

Edited February 4, 2022 by nukecad

[arnold12]

Still not able to enable UAC prompt ftom standard user account in win 11:

We're happy to announce the release of Malwarebytes Anti-Exploit Beta 1.13 Build 443.

This is a full Beta version with premium features available to Free users:

Download this Release version here

Malwarebytes Anti-Exploit 1.13.1.443

Protection Improvements:

• Enhanced exploit protection for Chrome browser

Stability/issues fixed:

• Fixed slowdown issues with MS Excel application
• Fixed false positives with MS Office products
• Disabled protection for some default applications
• Improved Logging capabilities
• Internal Product Improvements

[Arthi]

Hi arnold12,

We checked this behavior internally. With a product like Anti-Exploit, we cannot quite grant full access to a standard user account. If we do so, we stand to reduce the security of the product, like provide a potentially malicious program to edit settings, turn on/off protection etc. without admin rights.

Hence we see the current behavior appropriate.

 

 

[arnold12]

Well did you ever heard about the uac prompt? normally in other programs when they need to do something like change system setting uac prompt shows up when you click restart as administrator and you have to log in with an admin account

[Arthi]

Of course, but considering this is a free beta product - this is not one of the features that we are currently looking to invest our resources on. Hope you understand. Thanks.

[leo3487]

On 2/22/2022 at 6:01 PM, Arthi said:

Hi arnold12,

We checked this behavior internally. With a product like Anti-Exploit, we cannot quite grant full access to a standard user account. If we do so, we stand to reduce the security of the product, like provide a potentially malicious program to edit settings, turn on/off protection etc. without admin rights.

Hence we see the current behavior appropriate.

 

 

Then, why not trigger UAC when intend change important options?

or a button "Advanced" or "Expert, to trigger UAC and unlock most options

[leo3487]

1 minute ago, leo3487 said:

Then, why not trigger UAC when intend change important options?

or a button "Advanced" or "Expert, to trigger UAC and unlock most options

and a fter accept all changes (or cancel or apply) return to standar user privileges