Malwarebytes Anti-Exploit popup when opening browser---????

This just happened for the second time in the last 10 days or so and had never occurred before in the 2 years or so that I've been running MBAE.

I'm running Windows 7 Home Premium 64-bit SP1.

Malwarebytes Anti-Exploit free version 1.06.1.1019.

Along with MSE and Malwarebytes Premium 2.1.6.1022.

Pale Moon is the browser; version 25.1.0 (x86).

Both times, it happened when Pale Moon had been completely closed. I poked an icon on my taskbar which opens the browser and I get the popup. I'm not going to a web site of any kind, just opening the browser to a blank page.

Shutting down the browser and reopening it again is OK, the popup does not reappear.

I did not take a screen shot, but it was pinkish/reddish with words to the effect that it had blocked something.

I looked over the MBAE forum at Malwarebytes.org and did not see any reference to this.

Has this happened to anyone else? Known issue? Unheard of?

It seems to be benign and I cannot explain why it occurs only when opening the browser and only twice in thousands of attempts, both recently.

Hello:

That is normal behavior.

With version 1.06, instead of "logging" protection events, they are now displayed in a system tray popup.

These can be enabled or disabled from the GUI > settings > Show notification traybar tooltips.

You ought to see one each time you open a shielded application (unless you disable the option).

More info HERE and HERE

Cheers,

Moxie:

Hmmm.......... I looked at both of your links and found no explanation for why the behavior is apparently intermittent.

I use that taskbar icon hundreds of times per month.

The popup has appeared only twice.

Randomly? By design, every 229 browser openings?

What, exactly, is the "protection event" to which you refer?

Opening Pale Moon? If so, why intermittent?

If not, what?

Regardless, as you can see from attached pic, that setting was already unchecked.

The links explain the changed behavior/changelog for the 1.06 build, including the switch from logging protection events to system tray popups.

EDIT: "Protection event" = "XYZ is protected" notification. These were logged in versions prior to 1.06. Since version 1.06, they are are reported via the system tray popups, instead of the logs.

It shouldn't be intermittent.
If the setting is enabled, then you ought to see a system tray popup every time you open a shielded application, if you have that option enabled.
Since you are using the Free version, your browsers would be shielded.
That includes Pale Moon.

But I'm not sure what you mean when you say "I use that taskbar icon hundreds of times per month"???
MBAE runs in the background, silently.
(That's why a default installation doesn't even put a shortcut on the desktop.)
The program icon is in the notification/system tray, not in the taskbar.
Nonetheless, especially with the Free version, where the shields are pre-determined and pre-configured, there should be little/no need to open the GUI from the system tray icon.

If this doesn't explain or resolve your behavior, then you might want to try a clean reinstall.

Steps for that:

1. Close all apps
2. Uninstall MBAE from the Control Panel
3. Reboot
4. Delete the C:\ProgramData\Malwarebytes Anti-Exploit folder
5. Download and install the latest MBAE from http://downloads.malwarebytes.org/file/mbae

We can go from there...

Moxie:

See my revised post for my MBAE settings. That setting was unchecked and has been since day one.

Re the icon on my taskbar:

I am NOT repeat NOT referring to an icon to start or stop MBAE.

I am referring to an icon to start Pale Moon.

No more.

No less.

To quote my original post, "I poked an icon on my taskbar which opens the browser and I get the popup. I'm not going to a web site of any kind, just opening the browser to a blank page."

This is not the same message that I see to the effect that "MBAE is now protecting yada yada application".

It says that something was actually blocked.

Sorry for the misunderstanding -- when you said "that taskbar icon" it was not clear whether you were referring to the MBAE icon or another icon.

I'm just trying to help. Without screen shots, it can be confusing. I sincerely apologize.

If you are seeing an "Exploit Blocked" notifications when you open or use a shielded application, then it sure sounds as if MBAE is doing its job.
It could be that -- from time to time -- there *is* something on your browser page that MBAE is blocking.

I have just scanned quickly the MBAE support forum for similar reports and don't find anything that quite matches the behavior you describe.

There's really no way to know without gathering some diagnostic logs for the MBAE product manager.

I respectfully suggest the following for the most rapid and expert assistance with your issue:

1. Please follow the advice here to collect some basic diagnostic logs: [README FIRST] >>> Posts here need to include MBAE logs <<<
2. Post the logs in the MBAE support forum >>HERE<<.

pbust will review them and advise you further - he knows every line of code for the program, the intricacies of its operation, and will more than likely be able to resolve your issue promptly and expertly.


Thank you,

UsernameIssues said:

I would guess that Pale Moon (or an add-on) is checking for updates or making some other type of connection when started. Most checks like this only happen once every few days/weeks.

I'm not where I can test this :-(

That certainly sounds reasonable.

I don't see reports of this behavior at the support forum.
But that doesn't mean it's not happening.

As I mentioned in my last reply, the fastest and most certain way to get a definitive explanation/solution would be to post over in the MBAE support forum. The product manager is extremely hands-on, engaged and expert. I have no doubt he will be able to help.

Cheers,