Malwarebytes Anti-Exploit

Discussion in 'other anti-malware software' started by ZeroVulnLabs, Oct 15, 2013.

Page 3 of 164
  1. ZeroVulnLabs

    ZeroVulnLabs Developer (aka "pbust")

    Joined:
    Mar 5, 2012
    Posts:
    1,189
    Location:
    USA
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    With CIS running when you launch a browser, check with SysInternals ProcessExplorer (Find / Find Handle or DLL) and search for mbae.dll. Is it injected in the browser process space?
     
    ZeroVulnLabs, Oct 19, 2013
    #51
  2. Blues7

    Blues7 Registered Member

    Joined:
    May 11, 2009
    Posts:
    870
    Location:
    2500'
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    Thanks, pbust, for the reply. I'll keep watching to see if compatibility can be accomplished at some future point. :thumb:
     
    Blues7, Oct 19, 2013
    #52
  3. Solarlynx

    Solarlynx Registered Member

    Joined:
    Jun 25, 2011
    Posts:
    2,015
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    Yes, with CIS HIPS in Paranoid or Clean PC the shielded IExplorer, Opera and Firefox got this injection.
     
    Solarlynx, Oct 19, 2013
    #53
  4. ZeroVulnLabs

    ZeroVulnLabs Developer (aka "pbust")

    Joined:
    Mar 5, 2012
    Posts:
    1,189
    Location:
    USA
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    Cool, thanks for confirming. Last I heard from the Comodo guys a while back they were going to fix it so I guess it was fixed already. I will take it out of the incompatibility list. Thanks again!
     
    ZeroVulnLabs, Oct 19, 2013
    #54
  5. Solarlynx

    Solarlynx Registered Member

    Joined:
    Jun 25, 2011
    Posts:
    2,015
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    U r welcome. :)
    And thanks for teaching how to check these dll injections. I didn't know.
     
    Solarlynx, Oct 19, 2013
    #55
  6. guest

    guest Guest

    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    Does this issue affects also to chrome?
    It's also happens with Webroot SecureAnywhere 2104?

    will there be a free version with at least browser protection, win script host... the basics?
     
    Last edited by a moderator: Oct 19, 2013
    guest, Oct 19, 2013
    #56
  7. ZeroVulnLabs

    ZeroVulnLabs Developer (aka "pbust")

    Joined:
    Mar 5, 2012
    Posts:
    1,189
    Location:
    USA
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    WSA's IdentityProtection affects IE and FF by default AFAIK. As for 2014, here's Joe's answer:
    https://www.wilderssecurity.com/showpost.php?p=2285809&postcount=95

    There will be some type of freemium model, but details are not yet final. In addition everyone who participates and provides valuable feedback during the beta here at Wilders and Malwarebytes forum will get a free license.
     
    ZeroVulnLabs, Oct 19, 2013
    #57
  8. Brandonn2010

    Brandonn2010 Registered Member

    Joined:
    Jan 10, 2011
    Posts:
    1,854
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    My Shielded Applications number still doesn't go down when I close Chrome. Is that still a bug or is it just affecting me?
     
    Brandonn2010, Oct 19, 2013
    #58
  9. ZeroVulnLabs

    ZeroVulnLabs Developer (aka "pbust")

    Joined:
    Mar 5, 2012
    Posts:
    1,189
    Location:
    USA
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    Yes it's a bug. I'll add it to the known issues list.
     
    ZeroVulnLabs, Oct 19, 2013
    #59
  10. digmor crusher

    digmor crusher Registered Member

    Joined:
    Jul 6, 2012
    Posts:
    1,172
    Location:
    Canada
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    FYI

    So i booted up my computer, no MBAE icon in taskbar. Went to task manager and stopped process, then went to start menu clicked on icon and MBAE icon showed up in taskbar again, so this works.
     
    digmor crusher, Oct 20, 2013
    #60
  11. Sampei Nihira

    Sampei Nihira Registered Member

    Joined:
    Apr 7, 2013
    Posts:
    3,365
    Location:
    Italy
    Sampei Nihira, Oct 20, 2013
    #61
  12. ZeroVulnLabs

    ZeroVulnLabs Developer (aka "pbust")

    Joined:
    Mar 5, 2012
    Posts:
    1,189
    Location:
    USA
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    Did you add mbae-test.exe to EMET?
     
    ZeroVulnLabs, Oct 20, 2013
    #62
  13. Solarlynx

    Solarlynx Registered Member

    Joined:
    Jun 25, 2011
    Posts:
    2,015
    Solarlynx, Oct 20, 2013
    #63
  14. Sampei Nihira

    Sampei Nihira Registered Member

    Joined:
    Apr 7, 2013
    Posts:
    3,365
    Location:
    Italy
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    Immagine.JPG
     
    Sampei Nihira, Oct 20, 2013
    #64
  15. ZeroVulnLabs

    ZeroVulnLabs Developer (aka "pbust")

    Joined:
    Mar 5, 2012
    Posts:
    1,189
    Location:
    USA
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    I'm assuming the screenie means that the exploit test was not blocked by emet? Can you please also post a screenshot of processexplorer when this happens.
     
    ZeroVulnLabs, Oct 20, 2013
    #65
  16. BoerenkoolMetWorst

    BoerenkoolMetWorst Registered Member

    Joined:
    Dec 22, 2009
    Posts:
    4,872
    Location:
    Outer space
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    I just tried and EMET 4 blocks succesfully, when mbae-test.exe is added.

    So, then security software with exploit protection that protects the major browsers, pdf readers, media players etc but not mbae-test.exe will automatically fail the test? That would mean your comparison on Youtube is an unfair and not exactly a good test.

    I also tried to copy the test to a computer without Anti-Exploit installed, but when I tried to run it, it said some DLL was missing. Do you plan on releasing the test separately?
     
    Last edited: Oct 20, 2013
    BoerenkoolMetWorst, Oct 20, 2013
    #66
  17. guest

    guest Guest

    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    I'm using WSA 2014, Malwarebytes Anti-exploit and Hitman pro alert with chrome and I haven notice any problem, this is why I'm asking, What kind of issues should I have with this combination?
    Everything seems to be working fine
     
    guest, Oct 20, 2013
    #67
  18. ZeroVulnLabs

    ZeroVulnLabs Developer (aka "pbust")

    Joined:
    Mar 5, 2012
    Posts:
    1,189
    Location:
    USA
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    Yes you're right, I noticed that same thing after making the video. But then I also tested with mbae-test.exe renamed as %ProgramFiles%\Mozilla Firefox\firefox.exe and the results were the same. You can try this yourself.

    I'm guessing the missing DLLs are from the Visual C++ debug runtimes. You can download them from here:
    http://www.megafileupload.com/en/file/462633/Debug-DLLs-rar.html

    EDIT: changed URL to point to a file sharer that doesn't require installation of crappy Download Manager.
     
    Last edited: Oct 20, 2013
    ZeroVulnLabs, Oct 20, 2013
    #68
  19. ZeroVulnLabs

    ZeroVulnLabs Developer (aka "pbust")

    Joined:
    Mar 5, 2012
    Posts:
    1,189
    Location:
    USA
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    Issues with WSA detailed here:
    https://www.wilderssecurity.com/showpost.php?p=2285600&postcount=92

    Joe from Webroot confirmed they will fix it after releasing WSA 2014:
    At this point, the initial 2014 release is locked down but we should be able to get this into the first update.

    Can you double-check to see if the issue is resolved in your install of WSA?
     
    ZeroVulnLabs, Oct 20, 2013
    #69
  20. Sampei Nihira

    Sampei Nihira Registered Member

    Joined:
    Apr 7, 2013
    Posts:
    3,365
    Location:
    Italy
    Last edited: Oct 20, 2013
    Sampei Nihira, Oct 20, 2013
    #70
  21. guest

    guest Guest

    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    I don't have FF installed but with IE, seems to work OK.
    I have closed and opened IE several times:
    1) IE appears protected in the M antiexploit log
    2) The lock appears in the WSA icon indicating that is protecting IE
    3) Hitman pro alert popup appears.
    4) Not a single alert, popup, log... or anything that could indicate a conflict.

    Bug: The MAE log doesn't update when I have opened several times IE, that means that if I open and close 4 times IE the log will only create a entry the first time. But if I clear the log between each iteration it will create a new entry.
     
    guest, Oct 20, 2013
    #71
  22. ZeroVulnLabs

    ZeroVulnLabs Developer (aka "pbust")

    Joined:
    Mar 5, 2012
    Posts:
    1,189
    Location:
    USA
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    Can you check the following:

    1- While having both WSA and MBAE running, open IE
    2- Use the Find option within ProcessExplorer to look for mbae.dll

    Does mbae.dll show up under the IE process space?
     
    ZeroVulnLabs, Oct 20, 2013
    #72
  23. ky331

    ky331 Registered Member

    Joined:
    Jun 25, 2008
    Posts:
    158
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    Don't know how I did it, but just crashed MBAE:

    Got a pop-up from Microsoft C++ Debug Library (indicating)

    Debug Assertion Failed!

    Program C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
    File: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp
    Line: 52

    Expression: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)

    =====================

    Here's the information from Reliability Monitor, assuming it's meaningful/helpful to you:

    Description
    Faulting Application Path: C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe

    Problem signature
    Problem Event Name: APPCRASH
    Application Name: mbae.exe
    Application Version: 0.9.4.1000
    Application Timestamp: 5257defd
    Fault Module Name: MSVCR100D.dll
    Fault Module Version: 10.0.30319.1
    Fault Module Timestamp: 4ba220e7
    Exception Code: c0000005
    Exception Offset: 00000000000d3505
    OS Version: 6.1.7601.2.1.0.256.48
    Locale ID: 1033
    Additional Information 1: 2aed
    Additional Information 2: 2aed0b7a352c55b136593db7c1694604
    Additional Information 3: 5497
    Additional Information 4: 549782914dacf17991d40458ada7e0aa

    Extra information about the problem
    Bucket ID: 136236687
     
    ky331, Oct 20, 2013
    #73
  24. guest

    guest Guest

    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    You are right, it doesn't appear under IE process space, it works only when I disable WSA protection. But it works correctly, apparently in chrome.

    WSA is about to deploy a new version of Identity shield on WSA 2014, I will try again once it's released
     
    guest, Oct 20, 2013
    #74
  25. ZeroVulnLabs

    ZeroVulnLabs Developer (aka "pbust")

    Joined:
    Mar 5, 2012
    Posts:
    1,189
    Location:
    USA
    Re: Malwarebytes Anti-Exploit 0.09.4.1000

    I seem to remember a similar situation under XP with EMET4. It seems to block the exploit but crashes the application before it can show the EMET alert. But under Win7 it should work ok.
     
    ZeroVulnLabs, Oct 20, 2013
    #75
Page 3 of 164
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...