Office 97 and Opera 12 (the old Presto engine version)

[hake]

From using the experimental MBAE, I believe that the end of the road has been reached for Office 97 (NOT the Diamond Jubilee Edition of 1897) and Opera 12.  Any future protection will need to be achieved through EMET I think.

 

One particular problem for Office 97 would be with hardware supporting DEP and I had hoped that my dear old non-Nx 32bit Athlon XP 3000+ which powers my XP system would be immune, being incapable of giving effect to enforced DEP.  Sadly, other mysterious circumstances have put a spoke in the Office 97 wheel, hardware DEP or not.

 

I would be pleased to hear that others might have had more success than I with Opera 12 which process seems unable to terminate when running on Windows 7 64bit..  This is the 32bit version so maybe the 64bit version will prove more amenable to MBAE 1.05.3.1011.

 

It's probably not fair to expect compatibility between MBAE and obsolete but still really useful software and Opera 12 is such a deuce of a nice web browser.  Shame that Opera went Chrome.

[pbust]

What problems exactly are you having with MBAE 1.05 and Office 97? We'd like to solve them if possible.

 

As for your issue with Opera12, we're still trying to replicate it (haven't been successful so far, in our computers opera.exe always closes correctly).

[hake]

Excel,OFFICE 97
I have figured out my problem with Office 97 but there is no ready ideal solution. Using Windows XP, it is not simply practical to run in user mode so a couple of years ago I contrived a way to mitigate the hazards of running in admin mode. I use DropMyRights to run Word, Excel, etc., and also to run Directory Opus 6.2.15 (dopus.exe), a very nice alternative to Windows Explorer, which allows me to open MS Office documents in user mode.  It’s not perfect but it works.

This arrangement worked with MBAE 1.04.1.1012 (and previous) but not with Experimental MBAE 1.05.3.1011. I accept this and have deactivated the three MS Office shields in MBAE. This permits me to enable all mitigations in EMET 4.1u1 for winword.exe, etc., in some compensation for doing without MBAE MS Office protections.

I may work out a solution in due course but I’m not holding my breath. I am letting you know this in order to spare you further distraction of trying to figure out why MBAE should have a problem with MS Office 97.


OPERA 12.17
I have not yet discovered the circumstance causing the puzzle of Opera 12.17 (32bit) with Windows 7 (64bit). I have a 64bit installation executable for Opera 12.17 and believe that both 32 and 64 bit versions can be installed at the same time. Pity there seems to be no way of transferring my customisations for the 32bit version to the 64bit one.

[hake]

I should add that Office 97 works fine with Experimental MBAE 1.05 when used normally.  OnlineArmor has a very useful feature for XP users which enables applications to be selectively to run as default in user mode, assuming that OnlineArmor is running.  Alas OnlineArmor will not run without problems in company with Agnitum Outpost Security Suite Pro otherwise I wouldn't be writing this.

 

Ain't it complicated to get these security enhancers to behave properly with each other.

[hake]

Another afterthought: Office 97 runs code in the data segment and also the dynamic application heap.  If DEP is enforced, I expect that Office 97 will down tools.  I haven't actually tested this hypothesis because all my hardware is prehistoric (no Nx bits) except for my Win 7 system which is a mere eight years old.

[hake]

Opera 12.17 64bit version installed.  Mysteriously the 32bit Opera now terminates.  Hmmmmm,

[hake]

Quick retraction: Opera 64bit terminates, Opera 32bit will not unless assisted by Task Manager.

 

Wish I could edit my posts.

[hake]

There is a significant difference between Opera 12.17 32bit and the 64bit version.  The 64bit version uses a seperate plugin wrapper executable and the 32bit version does not.  There was one in the 32bit version but it was dropped after Opera 12.02.  I notice that I can enable all the EMET 5.1 mitigations for Opera 64bit including all the ROP mitigations but this cannot be done with the 32bit version which takes care of plugins in the browser executables.

[hake]

Office 97 Sorted!

The cause was that I had included the OSA.EXE and MSOFFICE.EXE processes in EMET.  In spite of them not being directly involved with MBAE, removing them from EMET seems to have eliminated the problem.  Experimental MBAE now protects my Windows XP Office 97 applications and with the additional protection bestowed by Experiental MBAE.  Note that the relevant system lacks hardware support for DEP so DEP enforcement by Experimental MBAE causes Office 97 no problems.

 

My experience is that MBAE tolerates the following mitigations in EMET, namely DEP, SEHOP, NullPage, HeapSpray and BottomUpASLR but NOT EAF.  For those systems which support it, the MandatoryASLR mitigation is also tolerated by MBAE.  All the ROP mitigations are NoNos regardless of whether the operating system is XP or later except for Opera 12.17 64bit which runs quite happily protected by MBAE with ALL EMET mitigations in effect on Windows 7 64bit.

[pbust]

Thanks for the testing details hake, and congrats on your 100th post !!!

[hake]

Thank you Pedro.  I hope that my musings, ravings and ramblings provide some extra insights which add knowledge.  I now embark on my progress to a double century.

 

In Office 97, MSOFFICE.EXE is the executable which, basically, manifests itself as a button bar on the desktop.  I have just decided to cease using this button bar altogether (after 17 years) on suspicion that running MSOFFICE.EXE was causing an obscure problem with Experimental MBAE 1.05.3.1011.  My suspicions have been rewarded as, although my previous changes had improved matters, glitches still occurred, manifesting themselves by Office 97 applications being unresponsive.  Those occasional glitches seem now to have ceased.

[hake]

Forgot to mention, I have also ceased to run OSA.EXE.  This little darling is said to 'improve' performance(?).  I find the opposite and, not needing the automation in Office 97, OSA.EXE has been 'retired'.

 

There, that's my 102nd post already.

[hake]

D_EEP disappointment.

Suddenly, MS Office applications became unresponsive.  I have reached the limits of my abilities to troubleshoot this.  Works fine with MBAE 1.04.1.1012.  I will install the next MBAE final release of 1.05 more in hope than in expectation.

[pbust]

New Experimental build 1012 published. Probably won't change much of the issues mentioned here, but worth a try:

https://forums.malwarebytes.org/index.php?/topic/160317-mbae-experimental-10531012/

[hake]

Thanks Pedro.  Got it.  I have substituted Office 2003 for Office 97.  Office 2003 works great with experimental MBAE on my main XP system.  I have similarly removed 32bit Opera on my Win 7 64bit system, now relying on 64bit Opera instead.  Again, the reported difficulty has ceased.  I am happy with this but frustrated that I could not supply more helpful information which might have led you understanding why the problems occurred.

 

I am looking forward with anticipation to the production release of MBAE 1.05.

[pbust]

Sounds great, thanks hake for performing all these tests!

[hake]

It has just occurred to me that this problem Opera 12.17 32bit installation inherited its appdata folders from a Windows XP installation of Opera 12.17.  I have recently realised that this included an installation of an obsolete Avast Online Security extension.  I removed it from the XP installation and this appears to have resolved another apparently unconnected issue with Agnitum Outpost Security Suite which showed a constant 2% CPU consumption (acs.exe process) after Opera had been in use for a while.  After removing Avast Online Security extension from Opera, this issue appears not now to be occurring.

 

I mention this to bring some closure to the issue.

[pbust]

Nice find!

 

And thanks for posting the conclusion!!

[hake]

Are there issues between MBAE 1.05 and OnlineArmor v7 ?  I have noticed that the Opera 12 issue in this thread occurs with MBAE 1.05 but not MBAE 1.04 and has only been observed on both Windows XP and Windows 7 systems using Emsisoft OnlineArmor.  The systems using other firewalls (Outpost and Windows own) do not exhibit this issue.

 

The existence of the redundant Avast Online Security in Opera 12 seems to be a red herring.  

[pbust]

None as far as we know. But if you do find any please let me know how to replicate.

[hake]

With the advent of MBAE 1.05.1.1016, I am seeing reason to be optimistic that the issue of Opera 12 (32bit) process termination has been fixed.  I have tried it on two XP systems so far and in both cases Opera consistently vanishes from the Task Manager process list on being closed.  One MBAE is Premium and the other is Free.

 

[hake]

Make that three Windows XP systems.

[pbust]

Cool, thanks for confirming!