cousinit99

Just got the auto-update notification for this. A little warning before the instantaneous, no-chance-to-save-anything reboot would've been nice.

+1 The issue is just as the OP described. Interestingly though, on one of my machines where MBAE doesn't update automatically, the issue is seemingly not present. For the past several updates to MBAE on this machine, MBAE fails to restart automatically after the update installer completes, and I have to go into Services.msc and start the MBAE service manually.

Yep, that did it, thanks. The option under Application Hardening is what did it. I re-enabled the other one under Application Behavior and it still works. Thanks

//facepalms self for not noticing the IE VB scripting option in Advanced Settings. HOWEVER, even with that option deselected, MBAE still blocks VBScript on said website. The plot thickens...

There's a false positive that's impeding the normal functionality of a certain OWA (Outlook Web App) website, and I can't add an exclusion for it in MBAE. Apparently, OWA needs VBScript for S/MIME to function. OWA throws an error (0x80040154 - Class Not Registered) when attempting to send an email if VBscript is blocked by MBAE. Conversely, the website functions normally if MBAE is disabled. The website is https://web-stlm01.mail.mil/owa/ . Unfortunately in this circumstance, the website is access-controlled and you need a CAC to log in to it. How can this be fixed or accommodated? mbae_logs.7z

I must be brain-dead this morning. I forgot to mention, this error didn't cause a BSOD. The OS session survived. All I had to do was restart mbae.exe. You're probably not going to get a crash dump from an application crash. .. ...

You sure you want a 16GB file? Will a kernel dump suffice?

Roger dodger..

Here's the XML details too, if that happens to help at all... - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">- <System> <Provider Name="Application Error" /> <EventID Qualifiers="0">1000</EventID> <Level>2</Level> <Task>100</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2013-10-23T22:19:28.000000000Z" /> <EventRecordID>20243</EventRecordID> <Channel>Application</Channel> <Computer>say whAAAAAt??</Computer> <Security /> </System>- <EventData> <Data>mbae.exe</Data> <Data>0.9.4.1000</Data> <Data>5257defd</Data> <Data>MSVCR100D.dll</Data> <Data>10.0.30319.1</Data> <Data>4ba220e7</Data> <Data>c0000005</Data> <Data>00000000000e3e68</Data> <Data>490</Data> <Data>01ced00c2297dfd0</Data> <Data>C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe</Data> <Data>C:\Windows\system32\MSVCR100D.dll</Data> <Data>2dd4b0d1-3c31-11e3-b044-10bf4882d256</Data> </EventData> </Event>

How funny.. I was googling MSVCR100D.DLL because mbae.exe had crashed and it was the faulting DLL.. In the process, I inadvertently stumbled upon this page.. Nope, it's still happening.. Here's the event details: Faulting application name: mbae.exe, version: 0.9.4.1000, time stamp: 0x5257defdFaulting module name: MSVCR100D.dll, version: 10.0.30319.1, time stamp: 0x4ba220e7Exception code: 0xc0000005Fault offset: 0x00000000000e3e68Faulting process id: 0x490Faulting application start time: 0x01ced00c2297dfd0Faulting application path: C:\Program Files\Malwarebytes Anti-Exploit\mbae.exeFaulting module path: C:\Windows\system32\MSVCR100D.dllReport Id: 2dd4b0d1-3c31-11e3-b044-10bf4882d256

Submitted..

http://www.youtube.com/watch?v=kGrHCM6rnwU The video shows MSE refusing to allow the item to leave quarantine.. I suppose you have a source to corroborate such a biased statement?

I'm not terribly surprised by this, but MSE seems to be refusing my deliberate attempts to de-quarantine the file.. *sigh* Just another one of Microsoft's QA failures..

I just wanted to let you guys know that "C:\Program Files\Malwarebytes Anti-Exploit\is-OI68V.tmp" is causing a false positive MSE as well..

Gracias.. Really love what you guys are doing.. Keep up the great work!!