Hi,
I encountered the following whenever I launched my IE11. Did not encounter this in EMET 5.2
Anyone also encountered the same?
EMET version 5.5.5871.31892
EMET detected ASR mitigation in iexplore.exe
ASR check failed:
Application : C:\Program Files\Internet Explorer\iexplore.exe
User Name :
Session ID : 1
PID : 0x213C (8508)
TID : 0x2F3C (12092)
Module : VBScript.dll
Windows 7 Ultimate SP1
Already have EMET 5.5 loaded.
Any help with this error trying to install 5.51 would be
appreciated.
EMET 5.51 install attempt:
There is a problem with this Windows Installer package.
A script required for this install to complete could not be run.
The mitigations offered by EMET have the potential to break some applications. This thread is to discuss people's experiences with applications that do not work correctly under EMET. The goal is to isolate which specific mitigations cause problems and for which applications (or plug-ins where appropriate). For those trying to determine which mitigations are causing problems, the most likely candidates are EAF and DEP.
Here are the issues the EMET support team has been able to confirm:
Application or plug-in | Issues that occur | Mitigation or setting causing the issues |
Skype | Fails to run | EAF |
NetFlix SilverLight app | Video playback in browser fails | EAF |
ATI Drivers | System blue screens on boot | System ASLR policy set to always on (must enable unsafe settings to see this option) |
iPod Synchronization service | Service crashes | System DEP policy set to always on |
AOL | System gives “out of memory” error messages | System DEP policy set to always on |
If you have experienced application compatibility problems with EMET, please share your experiences on this thread. The more detail you can provide about what the issues are and what
Any idea why EMET is crashing the Silverlight, in this case Lync server 2013 Control Panel:
Log Name: Application
Source: EMET
Date: 23.11.2015 20:55:40
Event ID: 2
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Description:
EMET detected StackPivot mitigation and will close the application: IEXPLORE.EXE
StackPivot check failed:
Application : C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
User Name : DOMAIN\UserA
Session ID : 2
PID : 0x27F4 (10228)
TID : 0x22F8 (8952)
API name : ntdll.NtSetContextThread
ReturnAddress : 0x75EC5B54
CalledAddress : 0x77C41920
Thread stack area range: [0x1C7BE000..0x1C7C0000]
StackPtr : 0x04EB9448
Petri
I downloaded an MS Excel file that was sent to me via email. I cannot open the said file. Whenever I will click on it, rather that MS Excel and the MS Excel file opening, Microsoft EMET would splash a notification screen statingEMET detected SimExecFlow mitigation and will close the application:EXCEL.EXE and it would never open the file in MS Excel.
I've installed EMET 5.51 on a Windows 10 Pro system to understand its potential use cases. As a test, I've added notepad.exe (in every combination from wildcard to exact pathname, etc.) to the protected list. I've ensured that all current notepad sessions are closed and then opened a new one. No green checkmark appears next to the running notepad and process explorer does not show EMET loaded into the notepad process. There are no error messages in the event log. I've done the same with calc with the exact same result. I then did the same thing for Chrome and interestingly enough all Chrome processes show up as protected in the EMET console.
Am I overlooking something?
Dear Support team,
I have the following questions on EMEt 5.5
Thanks
Chris
We are having a weird issue where Edge is crashing at startup after EMET v5.51 is installed on Windows 10 Enterprise x64 v1607.
We installed EMET v5.51 on a new instance of Windows 10 Enterprise x64 v1607, disabled all EMET configuration using EMET_Conf command line, and rebooted. Edge then crashes immediately when it is started, everytime. Tried with a different user account also and same issue. Even weirder is that even after uninstaling EMET and rebooting, Edge still crashes.
So it appears that just the action of installing EMET is breaking Edge for all users on the system, not necessarily an actual EMET Mitigation. Also EMET documentation indicates that it doesn't interact with Edge in anyway as well, so even weirder that EMET is breaking edge when it supposidly doesn't have any interaction.
EMET didn't log anything in the eventlog for Edge crashing, but there is this application Error for Edge:
Has anyone seen this before or have any ideas on why this might be occurs?
Until April 2015 I EMET (5.0/5.1) co-existed fine on my Windows 7 X64 computer. Then I started getting error messages when exiting normally from Word and Excel, usually with an invitation to inform Microsoft and then the app would restart with a blank document or sheet. No harm done, but annoying. I uninstalled Office 2013 Pro completely, then installed Office 365. I went through the gamut of disabling office Add-Ins, updating Abbyy FineReader, etc. Still the errors continued. Checking my Events log I found EMET sometimes associated with these errors. Updated EMET to v5.2 --the errors continued. Finally and reluctantly I uninstalled EMET, since when no errors have occurred.
Any thoughts, anyone?
Is the install of EMET on Windows 2008 R2 Server Core supported? I have made some attempts. The first challenge was finding a Server Core version of .Net Framework. But I am still having challenges getting EMET to install. The documentation does not cover a Server Core install.
Thomas Talley
Chris Bynum - MSFT
Have you guys made and utilities or tools to report EMET events?
I wanted to share some screenshots of a tool we have developed to ease EMET reporting. It has helped us a lot when monitoring our customers and their EMET client machines.
The tool is web based and in the main-view there are graphical statistics (high error counts are result of thousands of duplicate error events in EMET clients) and Excel-like log filteration -tool.
The second on shows mitigations and their amounts on specific computers.
Similar views are for per Application and for per User
Hi All!
Troubleshooting a DEP detection generated by a third-party add-in to Excel. Not knowing much about the (code) development aspect and how it relates to EMETs detections. What are some guidance I can give to the developers on what to look for in their code? What advanced compilation options should they ensure they are using?
Secondly, what would be the appropriate (temporary) actions to whitelist or exclude the add-in (or Excel in general) to cure the current crashes? For this question I'm sure you can point me to available threads in the forums or blog-posts that deal with these techniques.
Best,
Fredrik
