MartinC

I have got to the bottom of this eventually. The problem was not with the website I was visiting, the website was using a chatra.io chat facility and it was that website that was infected. I reported the matter to chatra.io and they were aware of it and were in the process of putting in a fix.

When I visit certain websites MalwareBytes blocks UCARECDN.COM. Can anyone offer any advise as to how I get rid of UCARECDN.COM? Trying to locate it on my PC I have searched: programs regedit services Browser Extensions LocalAppdata But found nothing. I have reinstalled Chrome. I have completed Malwarebyte and ESet scans, I have run CCleaner. But every time I visit I get the attached: I have found a lot of removal sites and have done the manual process, the automatic removal tools that are being offered for download look suspect, and Malwarebytes issues a warning for the majority of them. Any suggestions on where it is hiding would be appreciated, or a reputable removal tool. Or is there is anything in Malwarebytes that will give me more information - or just to block it without displaying a message.

If MalwareBytes are not going to fix this problem immediately please consider doing the right thing and emailing an alert advising people of the problem and the temporary workaround. I, like I imagine others will, spent several hours trying to get critical processes running again that had a big impact on the business, reinstalling Office, trying to isolate the problem, eventually uninstalling the update, posting on forums (which in my case pointed me at MalwareBytes being the culprit). Having now reinstalled the update, another hour, the workaround worked, it would have been good to know, saved a lot of time and made a problem a bit on a non-problem.

I have tried the quick repair and it didn't restore any files in that directory. The last time I tried doing an Office 365 online repair it wiped all the Microsoft products from my system and then wouldn't allow me to reinstall, which turned out to be a not uncommon problem but one that Microsoft doesn't seem to want to acknowledge. So while my Microsoft Office products are working I am reluctant to do the online repair as last time I lost half a day getting round the reinstall problem. Best regards Martin

I would add it, and had tried to add it, but the file does not exist in the location displayed. \16.0.7070.2033\OfficeClickToRun.exe I don't have a \16.0.7070.2033\ sub directory and the OfficeClickToRun.exe file is actually located in the directory C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe Do I exclude that file?

Missing Directory files Malwarebytes Anti-Ransomware.zip

Sorry - requested files attached Note that the OfficeClickToRun.zip was not quarantined, nor was it in the directory that was displayed in the warning message. It was in the directory that was in the log file. MBAMSERVICE.zip OfficeClickToRun.zip

Windows 10 Pro Malwarebytes Ransomware - Version 0.9.16.484 Ransomware Detected Process: C:\Program Files\Common Files\Micr...6.0.7070.2033\OfficeClickToRun.exe Action: Moved to Quarantine Office365 2016 had been reinstalled a few weeks earlier, but same software had previously been installed prior to installing Malwarebytes Anti-Ransomware and had been running for about four months - this false positive had never been reported before. I looked in the Quarantine tab but there were no entries listed. I checked the Office products and they were all functioning correctly so the message had no effect and so was ignored. Malwarebytes Anti-Ransomware left running. Only a regular full backup was running on the laptop when the message was displayed. No files supplied as no quarantined files were found. A couple of times I have found that the Malwarebytes was not running and would not restart - restart unresponsive - no message. On one occasion I reinstalled the software and that worked, on another occasion I completed a Windows update that was pending and that seemed to allow the MalwareBytes to restart.

Version 0.9.16.484 Same problem here although after it was reported it didn't affected the Office 2016 365 installation. The MalwareBytes had been running for weeks without any changes to the Office products so not sure why all of a sudden it considered it a threat. There was nothing listed under MalwareBytes quarantined tab and all Office products worked as normal.