none
Office 2013 apps, Firefox, Acrobat Reader and Chrome frequently shutdown by EMET 5.1

    Question

  • One of my users is having problems with EMET 5.1 shutting-down Excel, Outlook, Word, Firefox (43.04), Acrobat Reader (11.0.14) and Chrome (48.0.2564.97). The user gets "EMET detected Caller mitigation and will close the application" just before shutdown. The system is running 64-bit Windows 7 Enterprise. The user has disabled the Caller check for the affected apps numerous times but the checks become active again after about an hour. I logged into the user's system as an administrator, disabled the Caller checks and again they become active after about an hour. I also attempted to disable the Caller checks in the registry by changing the Caller value from 1 to 0 for the various applications in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EMET\_settings_\. These changes also revert back to active Caller checks. I suspect that the Caller checks are being reactivated by a GPO. 

    Here is the most recent Excel shutdown and application crash noted in the event viewer. The user had just opened Excel and clicked "File", "Open" and Excel was then shutdown by EMET. Is there any way to stop EMET from continuously doing this?

    EMET detected Caller mitigation and will close the application: EXCEL.EXE
    Caller check failed:
      Application C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE
     User Name:<REMOVED>  Session ID: 1 PID:0xB38(2872)
    TID:0x1D58(7512)API Name:kernel32.LoadLibraryW ReturnAddress: 0x5C505727
      CalledAddress    : 0x752A48F3
      TargetAddress : 0x5C505770
      StackPtr: 0x0046B02C

    Event[5918]:
      Log Name: Application
      Source: Application Error
      Date: 2016-02-02T10:35:45.000
      Event ID: 1000
      Task: Application Crashing Events
      Level: Error
      Opcode: Info
      Keyword: Classic
      User: N/A
      User Name: N/A
      Computer: <HOSTNAME REMOVED>
      Description:
    Faulting application name: EXCEL.EXE, version: 15.0.4787.1002, time stamp: 0x567a2cb1
    Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
    Exception code: 0xc000001d
    Fault offset: 0x00000000
    Faulting process id: 0xb38
    Faulting application start time: 0x01d15dcf09b5d1ec
    Faulting application path: C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE
    Faulting module path: unknown
    Report Id: 9fd7d0c6-c9c2-11e5-bb23-648099870e4b

    Tuesday, February 2, 2016 4:50 PM

All replies