Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Malwarebytes Anti-Exploit popup when opening browser---????

22 Jun 2015   #1
ignatzatsonic

Microsoft Community Contributor Award Recipient

Windows 7 Home Premium SP1, 64-bit
 
 
Malwarebytes Anti-Exploit popup when opening browser---????

This just happened for the second time in the last 10 days or so and had never occurred before in the 2 years or so that I've been running MBAE.

I'm running Windows 7 Home Premium 64-bit SP1.

Malwarebytes Anti-Exploit free version 1.06.1.1019.

Along with MSE and Malwarebytes Premium 2.1.6.1022.

Pale Moon is the browser; version 25.1.0 (x86).

Both times, it happened when Pale Moon had been completely closed. I poked an icon on my taskbar which opens the browser and I get the popup. I'm not going to a web site of any kind, just opening the browser to a blank page.

Shutting down the browser and reopening it again is OK, the popup does not reappear.

I did not take a screen shot, but it was pinkish/reddish with words to the effect that it had blocked something.

I looked over the MBAE forum at Malwarebytes.org and did not see any reference to this.

Has this happened to anyone else? Known issue? Unheard of?

It seems to be benign and I cannot explain why it occurs only when opening the browser and only twice in thousands of attempts, both recently.


My System SpecsSystem Spec
.
22 Jun 2015   #2
DaveSr

Windows 7 64 bit (32 bit on desktop)
 
 

I had something similar happen when launching any browser from an Icon on the desktop. Deleted all shortcuts and from File Manager, right clicked on the actual .exe program and selected send to Desktop, create shortcut.
My System SpecsSystem Spec
22 Jun 2015   #3
MoxieMomma

OEM Windows 7 Ult (x64) SP1
 
 

Hello:

That is normal behavior.

With version 1.06, instead of "logging" protection events, they are now displayed in a system tray popup.

These can be enabled or disabled from the GUI > settings > Show notification traybar tooltips.

You ought to see one each time you open a shielded application (unless you disable the option).

More info HERE and HERE

Cheers,


Attached Images
Malwarebytes Anti-Exploit popup when opening browser---????-2015-06-22_20-33-40.png 
My System SpecsSystem Spec
.

22 Jun 2015   #4
ignatzatsonic

Microsoft Community Contributor Award Recipient

Windows 7 Home Premium SP1, 64-bit
 
 

Moxie:

Hmmm.......... I looked at both of your links and found no explanation for why the behavior is apparently intermittent.

I use that taskbar icon hundreds of times per month.

The popup has appeared only twice.

Randomly? By design, every 229 browser openings?

What, exactly, is the "protection event" to which you refer?

Opening Pale Moon? If so, why intermittent?

If not, what?

Regardless, as you can see from attached pic, that setting was already unchecked.


Attached Thumbnails
Malwarebytes Anti-Exploit popup when opening browser---????-untitled-1.jpg  
My System SpecsSystem Spec
22 Jun 2015   #5
DavidE

Multi-Boot W7_Pro_x64 W8.1_Pro_x64 W10_Pro_x64
 
 

I've had this happen a couple of times with Pale Moon.
I looked in the MBAE Logs and there is an entry showing an exploit was blocked, but there is no info about what/where/hash ...
I re-open Pale Moon, no problem ...
My System SpecsSystem Spec
22 Jun 2015   #6
MoxieMomma

OEM Windows 7 Ult (x64) SP1
 
 

The links explain the changed behavior/changelog for the 1.06 build, including the switch from logging protection events to system tray popups.

EDIT: "Protection event" = "XYZ is protected" notification. These were logged in versions prior to 1.06. Since version 1.06, they are are reported via the system tray popups, instead of the logs.

It shouldn't be intermittent.
If the setting is enabled, then you ought to see a system tray popup every time you open a shielded application, if you have that option enabled.
Since you are using the Free version, your browsers would be shielded.
That includes Pale Moon.

But I'm not sure what you mean when you say "I use that taskbar icon hundreds of times per month"???
MBAE runs in the background, silently.
(That's why a default installation doesn't even put a shortcut on the desktop.)
The program icon is in the notification/system tray, not in the taskbar.
Nonetheless, especially with the Free version, where the shields are pre-determined and pre-configured, there should be little/no need to open the GUI from the system tray icon.

If this doesn't explain or resolve your behavior, then you might want to try a clean reinstall.

Steps for that:
  1. Close all apps
  2. Uninstall MBAE from the Control Panel
  3. Reboot
  4. Delete the C:\ProgramData\Malwarebytes Anti-Exploit folder
  5. Download and install the latest MBAE from http://downloads.malwarebytes.org/file/mbae
We can go from there...
My System SpecsSystem Spec
22 Jun 2015   #7
ignatzatsonic

Microsoft Community Contributor Award Recipient

Windows 7 Home Premium SP1, 64-bit
 
 

Moxie:

See my revised post for my MBAE settings. That setting was unchecked and has been since day one.

Re the icon on my taskbar:

I am NOT repeat NOT referring to an icon to start or stop MBAE.

I am referring to an icon to start Pale Moon.

No more.

No less.

To quote my original post, "I poked an icon on my taskbar which opens the browser and I get the popup. I'm not going to a web site of any kind, just opening the browser to a blank page."

This is not the same message that I see to the effect that "MBAE is now protecting yada yada application".

It says that something was actually blocked.
My System SpecsSystem Spec
22 Jun 2015   #8
UsernameIssues

W7 Pro SP1 64bit
 
 

I would guess that Pale Moon (or an add-on) is checking for updates or making some other type of connection when started. Most checks like this only happen once every few days/weeks.

I'm not where I can test this :-(
My System SpecsSystem Spec
22 Jun 2015   #9
MoxieMomma

OEM Windows 7 Ult (x64) SP1
 
 

Sorry for the misunderstanding -- when you said "that taskbar icon" it was not clear whether you were referring to the MBAE icon or another icon.

I'm just trying to help. Without screen shots, it can be confusing. I sincerely apologize.

If you are seeing an "Exploit Blocked" notifications when you open or use a shielded application, then it sure sounds as if MBAE is doing its job.
It could be that -- from time to time -- there *is* something on your browser page that MBAE is blocking.

I have just scanned quickly the MBAE support forum for similar reports and don't find anything that quite matches the behavior you describe.

There's really no way to know without gathering some diagnostic logs for the MBAE product manager.

I respectfully suggest the following for the most rapid and expert assistance with your issue:
  1. Please follow the advice here to collect some basic diagnostic logs: [README FIRST] >>> Posts here need to include MBAE logs <<<
  2. Post the logs in the MBAE support forum >>HERE<<.
pbust will review them and advise you further - he knows every line of code for the program, the intricacies of its operation, and will more than likely be able to resolve your issue promptly and expertly.


Thank you,
My System SpecsSystem Spec
22 Jun 2015   #10
MoxieMomma

OEM Windows 7 Ult (x64) SP1
 
 

Quote   Quote: Originally Posted by UsernameIssues View Post
I would guess that Pale Moon (or an add-on) is checking for updates or making some other type of connection when started. Most checks like this only happen once every few days/weeks.

I'm not where I can test this :-(
That certainly sounds reasonable.

I don't see reports of this behavior at the support forum.
But that doesn't mean it's not happening.

As I mentioned in my last reply, the fastest and most certain way to get a definitive explanation/solution would be to post over in the MBAE support forum. The product manager is extremely hands-on, engaged and expert. I have no doubt he will be able to help.

Cheers,
My System SpecsSystem Spec
Reply

 Malwarebytes Anti-Exploit popup when opening browser---????




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Malwarebytes Anti-Exploit 1.05.1.1014
New Features: Engine (DLL) code re-write to improve stability and compatibility. Added mitigations DEP Enformcement, Anti-HeapSpraying and BottomUp ASLR. Added new Layer0 "Application Hardening" protections. Added Layer1 new generic ROP protection mitigations. Added Layer1 new StackPivoting...
System Security
Malwarebytes Anti-Exploit 1.04.1.1012
https://forums.malwarebytes.org/index.php?/topic/156507-malwarebytes-anti-exploit-10411012/ https://www.malwarebytes.org/antiexploit/ A Guy
System Security
Malwarebytes has a new software- Malwarebytes Anti Exploit
has anyone installed this? https://www.malwarebytes.org/antiexploit/ I got an email from Malwarebytes about it I just installed the free version on my windows 8 and windows 7 test machines so far I am not seeing any problems but then again I just installed it :P anyone else try it?
System Security
Malwarebytes Anti-Exploit 1.03.1.1220 (Out of Beta)
Added new protection techniques for "Operating System Security Bypass Protection" Layer Added new protection techniques for "Application Behavior Protection" Layer Added ability to enable or disable pre-determined shields Added ability to manage (add/delete) custom shields Added visual...
System Security
Malwarebytes Anti-exploit 0.09.5.0250 Preview
https://forums.malwarebytes.org/index.php?showtopic=139353 Some personal observations. This program has worked silently in the background for me. But each time it has expired, it resulted in no browsers launching. The process was launched, but no browser GUI appeared. After I figured it out the...
System Security
Malwarebytes Anti-Exploit 0.09.4.2000
New Features: Compatibility with Windows 8.1. Fixed problem with log entries deleted after every reboot. Fixed missing line separators in the mbae-default.log logfile. Source A Guy
System Security


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 20:28.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App