Daily ExploitPayloadProcessBlock on Windows 10, empty quaratine?

[Johnny_B_Casual]

I see a lot of other people encountering essentially the same issue.

Beginning Sunday, 03-September, I've been receiving almost daily notifications from Malwarebytes Premium regarding blocked/quarantined exploit attempts. I notice that, while not at always at the same time, they have all occurred at 36 minutes past the hour; a brief glance at some other posts' detection history screenshots shows something similar (one was 5 minutes past the hour, for instance). Not sure if that's relevant, but it is curious.

Like others in the last few days, my quarantine is empty despite Malware stating one of the three items in each attempt has been quarantined.

I've already checked to see if the "Block penetration testing attacks" toggle is on; it is not. I have also already tried "Restore Defaults" yesterday; just a while ago today it happened again, 7:36 PM, right on the dot.

I don't want to jump ahead using steps you've given other people; I'll wait for an admin to start the process.

[Porthos]

2 minutes ago, Johnny_B_Casual said:

my quarantine is empty despite Malware stating one of the three items in each attempt has been quarantined.

Exploit protection does not actually quarantine anything, it just blocks/stops a process from running.

Let's get some logs so @Arthi can review and possibly advise.

Please do the following so that we may take a closer look at your system.

Please restart the computer and do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply
  
   

Thank you

[Johnny_B_Casual]

Thanks for the reply. Here it is.

 

mbst-grab-results.zip

[Arthi]

I have reached out to the OP via DM to collect some additional logging.

[Maurice Naggar]

@Johnny_B_Casual Your system has a applet named 

Brother PowerENGAGE

by Aviata. That app is really not needed. It seems a few other printers use this as well. The powerengage seems to include a ill-advised coding technique. Since it is not needed for printer to do actual work, suggest you Uninstall it & Restart Windows. Then see whether the alarm goes away.

[Johnny_B_Casual]

Thanks Maurice, I will uninstall that app and see how it goes. I am curious though, since I've had that app for at least the last year, and Malwarebytes since last January, why did it only just now start causing problems?

[Maurice Naggar]

My guess is that just recently the Exploit section of Malwarebytes was adjusted.  In any event, regardless of that, there is a very long discussion on the drawbacks & deficits of "powerengage" by aviata. Link

[Porthos]

The beta that was released today has the anti-exploit fix included.

You may get the beta by enabling BETA updates and checking for updates.

This is the version with the fix.