Attempted to update Office 365 today now gone

[geezer50]

I want my Office back now.

I was updating the Office2016 to correct the email issue I was having.  Anit-ransomware detected something during the update and said it was moving it to the quarantine.  I rebooted and there is nothing in quarantine and none of my office products works or is locatable on my system.  I need this to work this is now costing me money I cannot afford to lose....CheckResults.txtlogs (2).zip

Malwarebytes Anti-Ransomware (2).zip

[1PW]

Hello geezer50:

 

Has an attempt been made to perform a Repair an Office application on Office 2016 to correct this issue? If not, please try the repair and advise your system's status in your next reply to this topic.

 

Reference: Repair an Office application

 

Thank you.

[geezer50]

Yes, I have repaired my office applications, all of them that disappeared.

 

I have looked through the MBAMSERVICE log and have found where ARW detected the threat  @ 07:46:04.948

 07:46:04.948 812578 AntiRansomwareControllerImpl Received threat detection callback from ARW SDK, ObjectPath=C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.6568.2036\OfficeClickToRun.exe, MD5=8582c451302eaa2a834077412717b200730cd2741c7b61d587f4f0139a94d0fd  07:46:04.950 812593 MbCommonSigVerify   Opening C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.6568.2036\OfficeClickToRun.exe for verification  07:46:04.950 812593 MbCommonSigVerify   File Not Found - 2          07:46:04.951 812593 AntiRansomwareControllerImpl Error calculating file hash info        07:46:04.952 812593 AntiRansomwareControllerImpl Error getting file size        07:46:04.952 812593 AntiRansomwareControllerImpl Error calculating file hashes        07:46:04.953 812593 AntiRansomwareControllerImpl The detected file is NOT whitelisted, sending an action request to the SDK to kill this process. ObjectPath=C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.6568.2036\OfficeClickToRun.exe.  07:46:05.359 813000 AntiRansomwareControllerImpl Received a results callback from ARW SDK - ObjectPath = C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.6568.2036\OfficeClickToRun.exe, ActionTaken=ARW_ACTION_KILL_THREAD, Result = ARW_RESULT_SUCCESS, RebootRequired = No  07:47:45.160 912796 AntiRansomwareControllerImpl Anti-Ransomware protection has been stopped.  

​Notice the three 3 errors of ARW that resulted in the Killing of the ClicktoRun process.  Also notice that there is no log entry for the file moving to Quarantine.  I am not sure what your code is but this looks like a place to start.

 

I have placed the file C:\Program Files\Common Files\Microsoft Shared\ClickToRun on the exclusion list.  Will this allow the ClicktoRun to be successful next time.

 

Do you have a list of f​ixes like the Reference: Repair an Office application, if so where are they located?

 

I look forward to hearing from you.

[geezer50]

For future reference when someone loses their complete office package, they probable do not have email.

[1PW]

Hello geezer50:

 

It's good to read of the successful restoration!

 

"Please keep in mind that this is the first beta and there may be some bugs or issues that need to be worked out, so we encourage you to try it out in a non-production environment first." -Marcin Kleczynski, Chief Executive Officer, Malwarebytes Corp.

The very first public beta was just publicly announced on January 25th. Many would advise that a Beta release should never be installed on production computer systems. The most cautious may even wait till MBARW has been rolled into Malwarebytes' release products.

 

Do you have a list of f​ixes like the Reference: Repair an Office application, if so where are they located?

 

I am sorry but no. I simply remembered and sought the solution you might require with Google.

 

The MBARW Beta development team will analyze the logs you and other beta testers submitted for resolutions.

 

Thank you for your interest in MBARW Beta, and your valued feedback.

[geezer50]

Thanks, that is about what I did in the end, but it took a while to get there.  Has anyone looked at the service logs.  I have been monitoring them daily and it looks like there is an hourly request for updates but so far there have been no updates.  Periodically ARW sends reports to Malwarebytes but I have not been able to see what is in the report.

[AdvancedSetup]

If  you're having issues with the beta and require assistance with repair then I would suggest removing the beta. Then perform a System Restore back to before you installed the beta and it should return your computer back to the exact same way it was before you installed the beta.

 

 

Thank you