MWBAE blocks Excel from opening

[spinningcone]

Moving this post from the free addition forum since this is business edition i'm working with :

 

 

One user is having an issue with MWBAE, when they turn it on they can no longer open Excel (even a new blank sheet) It hangs for a long time then they get a box that says "command cannot be sent to the program"

Disabling AE or removing Excel from the protected list immediately clears the problem and the application opens up with no problems.

The log tab in AE doesn't indicate anything unusual, has the usual enforces (BottomUP ASLR etc) than shows "microsoft Office Excel is now protected" no AE errors appear but it's obviously doing something that breaks the application.

Has anyone else seen this?

Also how do you read the .log files  under "C:\ProgramData\Malwarebytes Anti-Exploit" ? it's all garbage in a text editor. I can't post them unless I know what data is in them.

[pbust]

At least post the alert and service log, as well as your FRST logs.

 

Thanks!

[spinningcone]

FRST requires installing an application to pull so I can't provide those.  are the alert and service logs different than the files under C:\ProgramData\Malwarebytes Anti-Exploit ?  the latter are unreadable and I can't post the files without knowing what data is revealed in those logs. are there reader applications for those files?  MWBAE gui only provides just the log tab (that I can see) which isn't helpful since it doesn't actually contain any useful troubleshooting data.

[pbust]

The mbae-alert.log and mbae-service.log are readable. Please post those at the very least.

[spinningcone]

OK i was confused about he alert log since it's not my computer and my version hasn't generated one . (username has been redacted)

alert log:

"2016-01-06T14:39:06.661-04:00";"xxxxx";"2984";"C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE";"1236";"svchost.exe";"1";"508";"453";"0x37BC0C2F";"";"";"0x001F0000";"0x001D3000";"";"";"";"";"";""
"2016-01-06T14:39:28.175-04:00";"xxxxx";"15592";"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE";"10400";"explorer.exe";"1";"508";"452";"0x37BC0634";"";"";"0x109F0000";"0x0E22B000";"";"";"";"";"";""


service log

"2015-03-24T16:49:31.805-04:00";"SYSTEM";"1";"1.05.2.1016";"";""
"2015-03-24T17:03:17.305-04:00";"SYSTEM";"2";"1.05.2.1016";"";""
"2015-03-24T17:03:30.253-04:00";"SYSTEM";"1";"1.05.2.1016";"";""
"2015-03-25T08:44:47.724-04:00";"xxxxx";"2";"1.05.2.1016";"";""
"2015-03-25T08:45:15.432-04:00";"xxxxx";"1";"1.05.2.1016";"";""
"2015-03-25T08:45:34.687-04:00";"xxxxx";"2";"1.05.2.1016";"";""
"2015-03-25T08:45:44.592-04:00";"xxxxx";"1";"1.05.2.1016";"";""
"2015-03-25T08:46:47.271-04:00";"xxxxx";"2";"1.05.2.1016";"";""
"2015-03-25T08:47:33.696-04:00";"xxxxx";"1";"1.05.2.1016";"";""
"2015-03-25T08:48:23.178-04:00";"xxxxx";"2";"1.05.2.1016";"";""
"2016-01-06T14:39:03.463-04:00";"xxxxx";"1";"1.05.2.1016";"";""
"2016-01-06T14:39:29.025-04:00";"xxxxx";"2";"1.05.2.1016";"";""
"2016-01-06T14:56:01.321-04:00";"xxxxx";"1";"1.05.2.1016";"";""
"2016-01-06T14:56:37.890-04:00";"xxxxx";"2";"1.05.2.1016";"";""
"2016-01-07T09:11:50.745-04:00";"xxxxx";"1";"1.05.2.1016";"";""
"2016-01-07T09:14:01.726-04:00";"xxxxx";"2";"1.05.2.1016";"";""

[pbust]

You have the old version. I'll send you instructions via PM to upgrade to 1.08.