Jump to content

MWBAE blocks Excel from opening


Recommended Posts

Moving this post from the free addition forum since this is business edition i'm working with :

 

 

One user is having an issue with MWBAE, when they turn it on they can no longer open Excel (even a new blank sheet) It hangs for a long time then they get a box that says "command cannot be sent to the program"

Disabling AE or removing Excel from the protected list immediately clears the problem and the application opens up with no problems.

The log tab in AE doesn't indicate anything unusual, has the usual enforces (BottomUP ASLR etc) than shows "microsoft Office Excel is now protected" no AE errors appear but it's obviously doing something that breaks the application.

Has anyone else seen this?

Also how do you read the .log files  under "C:\ProgramData\Malwarebytes Anti-Exploit" ? it's all garbage in a text editor. I can't post them unless I know what data is in them.

Link to post
Share on other sites

FRST requires installing an application to pull so I can't provide those.  are the alert and service logs different than the files under C:\ProgramData\Malwarebytes Anti-Exploit ?  the latter are unreadable and I can't post the files without knowing what data is revealed in those logs. are there reader applications for those files?  MWBAE gui only provides just the log tab (that I can see) which isn't helpful since it doesn't actually contain any useful troubleshooting data.

Link to post
Share on other sites

OK i was confused about he alert log since it's not my computer and my version hasn't generated one . (username has been redacted)

alert log:

"2016-01-06T14:39:06.661-04:00";"xxxxx";"2984";"C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE";"1236";"svchost.exe";"1";"508";"453";"0x37BC0C2F";"";"";"0x001F0000";"0x001D3000";"";"";"";"";"";""
"2016-01-06T14:39:28.175-04:00";"xxxxx";"15592";"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE";"10400";"explorer.exe";"1";"508";"452";"0x37BC0634";"";"";"0x109F0000";"0x0E22B000";"";"";"";"";"";""


service log

"2015-03-24T16:49:31.805-04:00";"SYSTEM";"1";"1.05.2.1016";"";""
"2015-03-24T17:03:17.305-04:00";"SYSTEM";"2";"1.05.2.1016";"";""
"2015-03-24T17:03:30.253-04:00";"SYSTEM";"1";"1.05.2.1016";"";""
"2015-03-25T08:44:47.724-04:00";"xxxxx";"2";"1.05.2.1016";"";""
"2015-03-25T08:45:15.432-04:00";"xxxxx";"1";"1.05.2.1016";"";""
"2015-03-25T08:45:34.687-04:00";"xxxxx";"2";"1.05.2.1016";"";""
"2015-03-25T08:45:44.592-04:00";"xxxxx";"1";"1.05.2.1016";"";""
"2015-03-25T08:46:47.271-04:00";"xxxxx";"2";"1.05.2.1016";"";""
"2015-03-25T08:47:33.696-04:00";"xxxxx";"1";"1.05.2.1016";"";""
"2015-03-25T08:48:23.178-04:00";"xxxxx";"2";"1.05.2.1016";"";""
"2016-01-06T14:39:03.463-04:00";"xxxxx";"1";"1.05.2.1016";"";""
"2016-01-06T14:39:29.025-04:00";"xxxxx";"2";"1.05.2.1016";"";""
"2016-01-06T14:56:01.321-04:00";"xxxxx";"1";"1.05.2.1016";"";""
"2016-01-06T14:56:37.890-04:00";"xxxxx";"2";"1.05.2.1016";"";""
"2016-01-07T09:11:50.745-04:00";"xxxxx";"1";"1.05.2.1016";"";""
"2016-01-07T09:14:01.726-04:00";"xxxxx";"2";"1.05.2.1016";"";""

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.