Malwarebytes Anti-exploit 0.09.5.0250 Preview

[A Guy]

The changelog is the following:

• Added new techniques for protection from stage1 exploits.
• Added new techniques for protection from stage2 exploits.
• Added new technique for stage1 and stage2 memory protections.
• Added new hooking of certain Windows 8.x specific functions.
• Added more verbose logging.
• Fixed bug with Acrobat Reader shield.
• Fixed bug installing MBAE in x64 systems where WinDir is in non-C drive.
• Fixed bug "missing MSVCP100D.DLL" when uninstalling MBAE.
• Fixed bug with excluding HitmanPro.Alert upgrades.
• Fixed bug with negative shielded applications counter.
• Fixed issue with Chrome extensions crash when stopping/starting MBAE.

https://forums.malwarebytes.org/index.php?showtopic=139353

Some personal observations. This program has worked silently in the background for me. But each time it has expired, it resulted in no browsers launching. The process was launched, but no browser GUI appeared. After I figured it out the first time, I knew what to do the next time it happened. Uninstalled the program, and go searching for the newer version. It does pop up a dialog normally, but not on my system.

This time I rebooted and was greeted by this box

I went searching and found a new discussion on the Malwarebytes forum

https://forums.malwarebytes.org/index.php?showtopic=139352

Fairly quickly pbust posted a link to the new version.

I installed that, but when opening threads on forums via Opera, I got an "Exploit was blocked" message and Opera was closed. This continued to the point I uninstalled the program again. I will try it again soon, and join and post at their forum if needed because I do want to use this. This is just a heads up for anyone using the program or planning to.

A Guy

 

[Golden]

I had similar issues with Chrome error messages popping up (sometimes Chrome crashing) when it first came out, so I ditched it.

It will be interesting to see how they go with this, but right now I'll sit out until its more stable.

 

[Borg 386]

I've had issues with it sometimes not being launched at boot time on 7 32. (Although Process Explorer showed it was running, the message presented was "path not found" during the times it wouldn't launch). Manually trying to launch it after killing the process was about a 50/50 chance of it coming up.

I got the same message this morning & d/l ed the newer version. I turned off the program, installed the new version & no problems so far (knock on wood). I'm also running it on 7 64 Pro & Win 8.1 with no problems (once again, knock on wood).

One thing that did give me a warning a while back, when I tried to upgrade VLC to a newer version, it wouldn't let me, it blocked the action. I had to disable it to allow the upgrade.

 

[aritra2116]

Yup. I had it too today. Installed the new version just a few moments ago. Pretty impressive

 

[ThrashZone]

I have a silly question but was this a additional download option like rootkit... or was it included in the basic download,
Although I have the pro version I didn't use or download anything additional beside the normal everyday updating which is automatic,
Cheers.

 

[A Guy]

The Anti-Exploit, like the Anti-Rootkit are stand alone, Beta applications so far.

Tried it again today, same thing, opened Nine Forums, clicked on a post and bam, Exploit blocked, Opera closes. That's a deal breaker for me Hoping they fix it, was working so well and I was using it from when it was Exploit Shield before Malwarebytes bought it.

A Guy

 

[M1GU31]

Yea I been testing it haven't had a issue yet.

 

[ThrashZone]

Okay thanks for confirming I don't test items like this because of the irritation factor,
Happy New Year

 

[Callender]

Check other installed security products

Hi,

I used Exploit Shield (the old version from ZeroVulnerabilityLabs) before it was acquired by MalwareBytes. It worked just fine apart from the occasional false positive detection. Then I decided to install Comodo Firewall and it played havoc with all installed browsers including Cyberfox and Opera. If I disabled Exploit Shield then the browsers would launch with no problem.

It seems that Exploit Shield had compatibility issues with Comodo Products and a few other products. The last time (several months ago) that I checked the MalwareBytes Anti-Exploit help forum it still listed Comodo Products as incompatible although the latest information appears to show that those issues have been resolved.

If your browsers launch successfully when MBAM Anti Exploit is disabled then it would appear that there are still a few issues to be sorted out.

https://forums.malwarebytes.org/index.php?showtopic=135127

 

[A Guy]

Until this version, I had no issue with it, unless the beta expired. Other then that it worked fine with my Comodo firewall. That isn't the issue. Now when surfing Nine Forums in Opera, it closes Opera and announces it blocked an exploit. A Guy

 

[Callender]

Thanks for the info.

Until this version, I had no issue with it, unless the beta expired. Other then that it worked fine with my Comodo firewall. That isn't the issue. Now when surfing Nine Forums in Opera, it closes Opera and announces it blocked an exploit. A Guy

Thanks for confirming that there's no longer a problem with Anti Exploit working alongside Comodo Firewall. I've just decided to install it again and it works fine with Opera - even on forums.

I haven't been able to reproduce your error but will try removal of Anti Exploit then a reinstall.

Interestingly I've discovered that it works with and protects Opera 64bit but doesn't detect when Cyberfox 64 bit browser is launched and there's no Cyberfox protection.

 

[Callender]

Something to try

Hi,

I uninstalled Anti Exploit and rebooted then checked for leftovers. It uninstalled cleanly. Then I reinstalled and still no problems. Checked EMET configuration and found no issues there.

It seems that several Opera users are reporting the same problem. If it was happening on my machine I might try disabling Anti Exploit (right click the icon in the system tray and choose "Stop Protection" or "Exit") so that I could launch Opera then try disabling any Opera add ons by typing:

operalugins

into the address bar and disabling any plugins.

Then disable extensions: Ctrl+Shift+E

Just to check if these are the possible cause although it seems unlikely.

Then exit Opera and re-enable Anti Exploit and try launching Opera once more. If it still doesn't launch it would mean reversing all of the above!

EDIT: After further Opera usage - it crashed when attempting to view a video embedded on a forum. Exited Anti-Exploit and restarted Opera. The video plays.

It's something the Malwarebytes team need to fix.

 

[A Guy]

I have Hitman Pro Alert also, but removing it made no difference. I don't have any extra plugins beyond Flash and Shockwave. It's an Anti-Exploit issue for me. If it doesn't work with Opera as is, as it has before, I won't change Opera to use it. Either they fix it, or I don't use it. A Guy

 

[Callender]

Malwarebytes Anti-Exploit 0.10.0.1000

Hi,

New version released Malwarebytes Anti-Exploit 0.10.0.1000 with some fixes including the Opera crash issue if using Opera12 64bit (That's the version that I use). It now runs as a service. Couldn't find an easy way to shut it down. Had to kill the process and stop the service.

Installed and tested - worked with no crashes. Still doesn't support Cyberfox 64 bit and for that reason I uninstalled MBAE.

   Note

Edit: (May 2015)

Malwarebytes Anti-Exploit Added Support for Cyberfox. In addition to the main browsers, MBAE Free now also protects Maxthon, Seamonkey, Palemoon, IceDragon, Cyberfox, Tor Browser Bundle, Waterfox and some others.

Uninstall leaves a couple of folders and files behind. Stopped the service and deleted it manually.


New features:

• New architecture runs MBAE as a Windows Service.
• New architecture runs MBAE in multi-user environments.
• New architecture prevents non-admin users from stopping protection.
• New architecture prevents non-admin users from managing exclusions.
• New architecture prevents non-admin users from clearing logs.
• New location for logs and auxiliary files under %AllUsersProfile%.
• New installer handles hot-upgrades to new MBAE versions.
• New installer completely uninstalls MBAE program files.
• Improved Start/Stop buttons have been unified into a single toggle button.
• Improved uninjection technique prevents crashes under certain conditions.
• Improved and less intrusive beta expiration messages.
• Improved GUI details.
• Fixed problem with traybar icon sometimes disappearing.
• Fixed problem when double-clicking on Desktop shortcut icon.
• Fixed an injection hook issue.
• Fixed an issue displaying Flash content under Opera12 x64.

 

[A Guy]

Thanks Callender. Funny, I just checked for update 2 days ago after a long time. Bad timing I guess

A Guy