Malwarebytes Anti-Exploit Known Issues

Malwarebytes 3.0 (MB3) -- Known Issues in Anti-Exploit Module: by Malwarebytes support phone number

• Malwarebytes Anti-Exploit blocks WScript: Users have been reporting issues with Anti-Exploit in MB3 3.6.1 v1.0.508, with occasional blocks from Malwarebytes Anti-Exploit on Windows scripts. We are working on a resolution to this issue. Until then, the workaround is to disable the Anti-Exploit module in Malwarebytes support phone number.

MBAE Standalone -- Known Issues and Conflicts: by Malwarebytes support number

• FireEye Endpoint Agent Version: 24.9.0: We have identified a hooking incompatibility (specifically, LoadLibraryEx API) with FireEye Endpoint Agent on Windows 10 machines which results in Internet Explorer crashes. Please contact FireEye to report this issue.
  The only known workaround is to either uninstall FireEye Endpoint Agent or unshield IE as a protected application in Malwarebytes support phone number Anti-Exploit.
• Malwarebytes customer service phone number Anti-Exploit blocks Microsoft Office applications on VMware Horizon View. The problem comes from VMware injecting its dll (vmwsci.dll) in allocated memory from APC. We cannot exclude this behavior from within the product since it reduces the protection offered by the product. Instead, as a workaround, users can disable MBAE Settings->Advanced Memory Protection-> Malicious Return Address detection for MS Office. Please also make sure to report this issue to VMware Malwarebytes support phone number.

• Sophos Intercept X(HitmanPro) Both MBAE and Intercept X have exploited mitigation products providing similar functionalities Malwarebytes support phone number. However, MBAE provides more comprehensive protection due to its Layer0 and Layer3 protections. More information here. Malwarebytes phone number It is not recommended to run both products alongside each other, and if done so, will result in unpredictable crashes/hangs of protected applications. We suggest that you uninstall/disable the Intercept X module of Sophos EndPoint security on computers where MBAE is installed Malwarebytes customer service phone number.
• Enhanced Mitigation Experience Toolkit (EMET). Both EMET and MBAE have exploited mitigation products that apply similar protections and apply similar API hooking & techniques. However, MBAE provides more comprehensive protection due to its Layer0 and Layer3 protections. More information here. Malwarebytes phone number It is not recommended to run MBAE and EMET together. Some users have reportedly managed to run both together by tweaking the EMET techniques, but this is not a Malwarebytes support number officially supported configuration.
• Trusteer Rapport. Malwarebytes customer service phone number Trusteer's "Pinpoint technology", which tries to detect the presence of Trusteer through a webpage, introduces a conflict whereby it cannot detect the presence of Trusteer's hooks. Malwarebytes phone number There is a long history of complaints about IBM's lack of interest in fixing Rapport's conflicts with dozens of security applications. We've managed to make Trusteer work with most web browsers but in the case of Pinpoint technology, Malwarebytes customer service phone number it does not know how to deal with basic chained API hooks. We are working on a new mechanism to handle these types of conflicts Malwarebytes support number.

• ESET9. A bug exists in the API hooking mechanism of ESET9 that triggers when using ESET9 + MBAE + Firefox. Malwarebytes customer service number The Firefox crash shows a stack overflow typically generated by ESET. This problem is likely also happening between ESET9 and other security products as well Malwarebytes helpline phone number.
• New Comodo Bug. We found a second new bug in Comodo which may cause conflict with MBAE and result in browsers not being able to open correctly. It seems when MBAE injects after Comodo there is no problem, Malwarebytes helpline phone number but if Comodo injects after MBAE then Comodo doesn't handle the chained hooks correctly. A fresh re-install of MBAE might temporarily solve the problem (as it sometimes makes MBAE handle the API hooks after Comodo) but the definite bug fix must come from Comodo Malwarebytes customer service number.
• McAfee (new): We recently identified another bug in the hooking engine of McAfee HIPS that causes crashes of protected applications Malwarebytes customer service number.
  McAfee HIPS hooking engine fails to disassemble an instruction and generates a breakpoint exception in HcThe.dll resulting in the crashes Malwarebytes helpline phone number.
  HcThe.dll hooks a couple of Windows APIs and in some specific cases, if a function is already hooked and McAfee HIPS attempts to hook this API, it fails to disassemble the instruction and generates a breakpoint exception. Malwarebytes customer service phone number This conflict is not just with MBAE but with other security products dealing with API hooks as well. If you are experiencing this issue, please contact McAfee to report this bug to them. We are working on a new mechanism in MBAE to handle these types of issues caused by buggy third-party code Malwarebytes customer service number.
• McAfee HIPS (old). We have identified an API hooking bug in older versions of McAfee HIPS that may cause a conflict with MBAE. The bug is located in the HCTHE.DLL component of McAfee HIPS. Simply disabling Malwarebytes phone number HIPS does not disable the hooking or solve the bug, so the solution is to upgrade to a fixed version of McAfee HIPS. We are working on a new mechanism in MBAE to handle these types of issues caused by buggy third-party code Malwarebytes helpline phone number.

• Websense Endpoint hooks KernelBase!LoadLibraryExW API via QIPCAP64.DLL. MBAE also hooks this API Malwarebytes helpline phone number. However, due to a bug in Websense's hooking mechanism, Malwarebytes customer service number it improperly handles the hook and may create crashes when opening Word, Excel or other applications. If you are experiencing this issue please contact Websense to report this bug to them ("bad attempt to copy jmp qword instruction rip based"). We are working on a new mechanism to handle these types of conflicts Malwarebytes support number.
• Ghostery Add-on for Internet Explorer 11 by Malwarebytes phone number alongside MBAE, or any other product that hooks wine APIs, makes IE crash. This is because Ghostery is making incompatible API hooks, i.e. without taking into consideration that there might be other products hooking the same APIs Malwarebytes support number.