The above is as much of the command as the popup for anti-exploit shows me. I've confirmed it's a real popup and not one from my browser. It's happened a few times in the last week, though I didn't check the command very closely at the time (though I'll be on the watch for it now). I expect it's similar each time if not the same.
In January 2016, Malwarebytes unveiled advanced anti-ransomware package Endpoint Security,[19] and announced that it had raised $50 million in investment from Fidelity Management and Research Company. Kleczynski stated that the funds would be used primarily for the company's hiring, product development and marketing assets.[11] In June, Malwarebytes announced a strong growth in sales of over 75 percent in the first quarter of the year compared to 2015, with billings surpassing $100 million. The corporate subscription base for the company was reported to have grown by 90%.[20] In September, Proofpoint, Inc. CEO Gary Steele joined the company's board of directors, with Kleczynski citing his "deep expertise in the security software industry, and his proven ability [at] increasing sales revenue" as the main reasons for his appointment.[citation needed] In October the company purchased AdwCleaner, a Windows program used to clean adware and Potentially Unwanted Programs (PUPs) from computers.[21] In February 2017 the company acquired Saferbytes, an Italian security start-up specialized in anti-malware, anti-exploit, anti-rootkit, cloud AV, and sandbox technologies.[22]
There are plenty of answers available which detail how antivirus and anti-malware programs work, including details on signatures, heuristics, sandboxing, etc. However, there seem to be relatively few resources on how anti-exploit programs (such as EMET, MBAE and HitmanPro.Alert) actually detect and prevent exploits.
I'll answer this based on my experience with the CBMC compiler. I never used HitmanPro, malwarebytes anti-exploit or Microsoft's EMET but I do not see any reason why they would do things completely differently from CBMC.
If we look at the malwarebytes anti-exploit video (kindly researched by OP), we see that MBAE could find an exploit by identifying a downloaded malicious file. That is exactly how a modern anti-virus program works: it checks the signature of a known malware (or "exploit payload" if you want to call it that way) and stops its execution if it matches.
There are different approaches that anti-exploit programs use. If you know how an exploit works and what kind of exploitation technique it uses, (ROP, Heap Spraying etc.) it's pretty simple to understand anti-exploit products.
So how an anti-exploit program can prevent this ? Here is a very simple and commonly used approach;Let's assume you would like to protect Firefox against heap spraying attacks. Whenever firefox process starts , you can inject yourself to it and then you can pre-allocate these kind of common heap spray addresses (0x0c0c0c0c) in Firefox. So if an heap spraying exploit that uses common predictable addresses (0x0c0c0c0c, 0a0a0a0a etc.) will not work against this protected firefox process. A simple API call to pre-allocate an address; VirtualAlloc(SprayAddress, 0x400, MEM_RESERVE,PAGE_NOACCESS)
Update: On Windows 10, the built-in Windows Defender antivirus now includes exploit protection. This replaces Microsoft's EMET, and is installed by default for everyone. Malwarebytes Premium now includes anti-exploit features, too---it's no longer a separate tool.
HitmanPro.Alert offers similar anti-exploit protections to those found in Malwarebytes Anti-Exploit and EMET. This is the most recent option available here, and -- unlike the above tools -- these protections aren't available in the free version. You'll need a paid license to benefit from the anti-exploit protections in HitmanPro.Alert. We don't have as much experience with this solution, as HitmanPro.Alert just recently gained these features.
We include this here just for the sake of completeness -- most people will be fine with a free anti-exploit tool to protect their browsers. While HitmanPro.Alert may tout some more specific memory protections over other solutions, it won't necessarily perform better than MBAE or EMET against real-world threats.
While you should use an antivirus (even just the Windows Defender tool built into Windows 10, 8.1, and 8) as well as an anti-exploit program, you shouldn't use multiple anti-exploit programs. It may be possible to rig Malwarebytes Anti-Exploit and EMET to work together, but you aren't necessarily getting twice the protection -- there's a lot of overlap.
MalwareBytes Anti-Exploit protects against all known and unknown 0-day vulnerability exploits, protecting users where traditional antivirus and security products fail. It consists of an innovative patent-pending vulnerability-agnostic application shielding technology that prevents malicious vulnerability exploits from compromising computers. Includes "shields" for all major browsers (IE, Firefox, Chrome, Opera) and all browser components such as Java, Adobe Reader, Flash and Shockwave. Blocks all exploit kits such as Blackhole, Sakura, Phoenix, Incognito without requiring any signature updates. No need to train or configure, MalwareBytes Anti-Exploit is 100% install-and-forget anti-exploit solution.
The program steps in when exploits bypass the first and second line of security of a computer system. So, instead of allowing the exploit to run on the system, they are blocked from doing so by anti-exploit software.
aa06259810