False on Office 2016 Updater

[ridgwel]

• Finish the detection process and reboot if asked by Anti-Ransomware.  Was not asked to do so.
• After reboot disable the Anti-Ransomware protection.  Did not reboot since wasn't asked to.
• Restore the file from Quarantine and add it to the exclusions.  File was not quarantined
• Find the restored EXE file that was quarantined, right-click on it and click "Send To >> Compressed (Zipped) Folder". Attach this ZIP file also to your report.  Nothing was quarantined, so no EXE file to capture.
• Create a ZIP of the directory C:\ProgramData\Malwarebytes\Malwarebytes Anti-Ransomware\ and attach it to your post. Tell me how to attach.
• Create another ZIP of the directoy C:\ProgramData\Malwarebytes\MBAMService\logs\ and attach it to your post.  

Here is the alert I received:

My Office 2016 Update is still trying to update.  What can I do to straighten Office Updater so that it finishes?

 

THANKS

[1PW]

Hello ridgwel and

 

Please republish just the attachments.

 

However, this time do not colorize anything and maybe they will post correctly.

 

Thank you.

[ridgwel]

Sorry 'bout that.....

Malwarebytes Anti-Ransomware.zip

MBAMService.zip

[1PW]

Hello ridgwel:

Not to worry. Second time was a charm.

Thank you for beta testing MBARW and your feedback.

[SystemRat]

I have the exact same experience.

 

On booting my machine this morning the anti ransom ware popped up with a message telling me Officeclicktorun.exe was bad and was quarantined.  

 

On checking there was nothing in the quarantine.

 

All my Office apps stopped working.

 

I removed anti ransom ware fearing other stuff might be affected.

 

I restored the deleted file from a backup but Office still did not fire up so I did an online repair via add remove programs.

 

The quick repair option did not work but the online repair did after which I had to reenter my product key for office.

 

Hope that helps some one else who may experience this too.

 

Oh I am running Symantec endpoint 12.1.6 and Malwarebytes licensed. On Windows 10 pro 64bit - No prior issues with anti ransom ware other than it wakes up disable at times but that seems to be an issue other have experienced also.

Edited March 14, 2016 by SystemRat

[ridgwel]

I have the exact same experience.

 

On booting my machine this morning the anti ransom ware popped up with a message telling me Officeclicktorun.exe was bad and was quarantined.  

 

On checking there was nothing in the quarantine.

 

All my Office apps stopped working.

 

I removed anti ransom ware fearing other stuff might be affected.

 

I restored the deleted file from a backup but Office still did not fire up so I did an online repair via add remove programs.

 

The quick repair option did not work but the online repair did after which I had to reenter my product key for office.

 

Hope that helps some one else who may experience this too.

 

Oh I am running Symantec endpoint 12.1.6 and Malwarebytes licensed. On Windows 10 pro 64bit - No prior issues with anti ransom ware other than it wakes up disable at times but that seems to be an issue other have experienced also.

 

I did exactly what you did.....to the letter.....including removing the anti-ransom software!  I still have not re-installed the anti-ransom.  I'm hoping to get that software re-installed after my courage returns.

[1PW]

Hello ridgwel:

 

When you are ready, assistance is yours for the asking.

 

Thank you for your feedback.

[mistertonmick]

i have just had a ransom-ware blocked on office 2016 updater,closed the window and opened the anti ransom-ware box and nothing showing in quarantine.

also pleased to trial the software on 3 machines after having being hit in the past twice.

[Mark]

Same detection on Office 2016 here this morning. Quarantine empty, Office (Pro) no longer working. Uninstalled MBARW, rebooted. Tried the online Office repair but it failed ; my guess is it failed because I had an Office 2010 component (SharePoint) still installed and the 2016 installer didn't like that. Tried to uninstall SharePoint but that erorred out as well. System Restore was of no help, the problems were there after a successful restore (W7).

Finally re-imaged (had a fresh image from 30 minutes prior), disconnect the LAN cable before reboot, disabled and uninstalled MBARW, all is well.

Beta testing is fun

[mistertonmick]

tried office repair,failed.had to reinstall,also disabled anti ransomware software while doing this.then tried enabling anti ransomware and it only reenabled after restart of computer.

seeing the message was on computer for a brief time i have no idea what words to write in the exclusions part of the software.this could also be useful for the malwarebytes anti ransomware team to see if the exclusion works in case microsoft do another 365 update.

maybe 1PW could assist on could help with this seeing it as affected a number of people around the world today.i like malwarebytes products and they give you confidence.

[Decrypterfixer]

We are aware of this FP and are working hard to include a fix for it. For a temporary fix please disable MBARW while updating office and enable again after. Thanks for the feedback!

[SystemRat]

:-) Problem being without tweaking Windows 10 updates when Microsoft wants it to and there is not an option to disable that.

I've modified my install so i have control over that but i am also very security focused so i tend to hit the check for updates now / install button. BOOM.