locked
EMET v4 Beta Incompatibility RRS feed

  • Question

  • Hi all, not sure if this is the right place to report bugs.. please let me know where to report bugs if not here :)

    I have just upgraded from EMET 3.5 Tech Preview to EMET 4.0 Beta on Win 7 Enterprise SP1 / IE9 / Office 2010, imported the Recommended programs set and rebooted and now I notice none of my apps will launch at all. IE, Outlook etc none of them will run unless I go into EMET and remove the application from the list.

    I tried the recommended security settings and maximum security settings and it makes no difference.

    Never had any problems with v3.5 except for Snipping tool crashing IE which I see is in the list of bugfixes.




    • Edited by Nullsec Tuesday, April 23, 2013 3:48 AM
    Tuesday, April 23, 2013 3:22 AM

All replies

  • Oh I found the problem, guess what, it was McAfee H-IPS lol.

    I know this is probably something a lot of people would disable, however it never interfered with EMET v3.5 so this seems to be broken since EMET v4 Beta. I would prefer to run them both in parallel if possible because McAfee does give the added IPS signature capability on top of the generic mitigation that EMET will offer. (Likely they are both now conflicting somehow since v4).

    I also noticed I do not get any H-IPS events logged anywhere in McAfee during application failure to launch, so the apps seems to fail before McAfee gets hold of the process, my guess is EMET is grabbing them first but I do not see any EMET popups or alerts at all.

    Im running McAfee H-IPS version 8.0.0.1919 (disabled Host IPS, left Network IPS enabled and that is fine) and VirusScan Enterprise 8.8 (which is enabled and ok).

    MS guys can you look into this one please :)



    • Edited by Nullsec Tuesday, April 23, 2013 3:57 AM
    Tuesday, April 23, 2013 3:34 AM
  • Probably worth mentioning, I tried unticking all EMET options for an app eg. IE and IE still failed to launch.

    eg. IE wouldnt launch until I completely removed the line item for IE from the EMET application list.

    Tuesday, April 23, 2013 5:06 AM
  • Hi Nullsec,

    Thanks for reporting this issue. Mentioning it here should save others time in figuring out why their programs no longer launch.

    In addition to this thread that you have created, I would also suggest sending an email with as much detail as you can to the EMET 4.0 Beta Feedback address as mentioned at the end of Page 40 (section 8: Support) of the EMET 4.0 Beta User’s Guide.

    The User’s Guide is a PDF file located in the EMET installation folder. By default this is located at:

    32 bit Windows:    C:\Programs Files\EMET 4.0 (Beta)
    
    64 bit Windows:    C:\Programs Files (x86)\EMET 4.0 (Beta)

    I hope this helps. Thank you.

    Tuesday, April 23, 2013 9:38 AM