Troubleshooting: EMET 5.1 Prevents Internet Explorer From Running (Caller Mitigation)

Version Affected: All
 
 

Overview

The Enhanced Mitigation Experience Toolkit (EMET) 5.1 throws a "Caller Mitigation" alert, and either shuts down Internet Explorer, or — if the EMET setting has been changed to "alert but do not block" — shows multiple pop-up windows on the right-hand side of the screen, preventing normal use of Internet Explorer.

 

Cause

If Sophos Security (anti-virus) is installed on the machine, there is a known compatibility issue between Sophos and EMET, where Sophos' Buffer Overflow Protection detection triggers EMET alerts constantly.

 

Resolution:

1. Open the Sophos console on the server.
2. Go to Configure anti-virus and HIPS, then Behavior Monitoring.
3. Uncheck Buffer Overflow Protection.
4. Uncheck Enable behavior monitoring. This is sometimes needed because the Sophos client may not adhere to disabling Buffer Overflow Protection alone — turning off all behavior monitoring may be necessary to restore Internet Explorer functionality.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.