locked
Problem with Outlook 2010 with EMET 5 TP RRS feed

  • Question

  • When I try to open Outlook 2010 with EMET 5 set to recommended settings it fails with a Simexecflow error. Deselecting all mitigations and trying again gives the same error. Tried deselecting Deep Hooks and Outlook works OK, so tried enabling the mitigations and all still works OK. Secting Deep Hooks causes the Simexecflow error.

    Is there any reason for this problem and any work-round to make Outlook work with Deep Hook enabled??

    Tuesday, March 25, 2014 12:16 PM

All replies

  • When I try to open Outlook 2010 with EMET 5 set to recommended settings it fails with a Simexecflow error. Deselecting all mitigations and trying again gives the same error. Tried deselecting Deep Hooks and Outlook works OK, so tried enabling the mitigations and all still works OK. Secting Deep Hooks causes the Simexecflow error.

    Is there any reason for this problem and any work-round to make Outlook work with Deep Hook enabled??

    I have now tried using Word 2010, which seems to work OK but on shutdown gives an error:

    Problem signature:
      Problem Event Name: APPCRASH
      Application Name: WINWORD.EXE
      Application Version: 14.0.7113.5001
      Application Timestamp: 52866c04
      Fault Module Name: EMET.DLL
      Fault Module Version: 5.0.0.0
      Fault Module Timestamp: 530b82f5
      Exception Code: c0000005
      Exception Offset: 0002b5cb
      OS Version: 6.1.7601.2.1.0.256.1
      Locale ID: 2057
      Additional Information 1: 45fc
      Additional Information 2: 45fc2d309b68ba45f0ab6d26aa89f613
      Additional Information 3: 2126
      Additional Information 4: 212673e4d3966f14628a4684356d1887

    This also happens with Excel 2010:

    Problem signature:
      Problem Event Name: APPCRASH
      Application Name: EXCEL.EXE
      Application Version: 14.0.7109.5000
      Application Timestamp: 522a4031
      Fault Module Name: EMET.DLL
      Fault Module Version: 5.0.0.0
      Fault Module Timestamp: 530b82f5
      Exception Code: c0000005
      Exception Offset: 0002b5cb
      OS Version: 6.1.7601.2.1.0.256.1
      Locale ID: 2057
      Additional Information 1: 45fc
      Additional Information 2: 45fc2d309b68ba45f0ab6d26aa89f613
      Additional Information 3: 2126
      Additional Information 4: 212673e4d3966f14628a4684356d1887

    This does seem to point to EMET.DLL causing the problem as both the exception code and offset are exactly the same.

    Tuesday, March 25, 2014 12:38 PM
  • I have the same issue for Iexplorer, Lync and Adobe Reader. 

    Problem signature:

      Problem Event Name: APPCRASH
      Application Name: iexplore.exe
      Application Version: 8.0.7601.17514
      Application Timestamp: 4ce79912
      Fault Module Name: EMET.DLL
      Fault Module Version: 5.0.0.0
      Fault Module Timestamp: 530b82f5
      Exception Code: c0000005
      Exception Offset: 0002b5cb
      OS Version: 6.1.7601.2.1.0.256.4
      Locale ID: 1033
      Additional Information 1: 45fc
      Additional Information 2: 45fc2d309b68ba45f0ab6d26aa89f613
      Additional Information 3: 2126
      Additional Information 4: 212673e4d3966f14628a4684356d1887

    Tuesday, March 25, 2014 2:09 PM
  • I have checked all office 2010 programmes and all start OK but fail on shutting down. This is a MAJOR problem which has been with us in EMET 4.1 as well, so it should have been sorted long ago. It doesn't give confidence in EMET when it fails with Microsoft's own programmes.

    As I started IE11 to write this EMET came up with an error - ASR mitigation Adobe Flash Player 12, so it also affects other programmes as well.

    More work needs to be done to find the reason for these problems ASAP and why they ALL seem to point to EMET.DLL!

    Wednesday, March 26, 2014 11:36 AM
  • Try disabling MandatoryASLR  module. 
    Friday, March 28, 2014 10:01 PM
  • I got Outlook 2010 SP1 to function with EMET 4.1 by only disabling SEHOP... otherwise it would crash.  Win7x64 SP1.  Shame the stock EMET app rules don't come with these 'better' defaults.
    Tuesday, April 29, 2014 7:34 PM