Jump to content

Attempted to update Office 365 today now gone


Recommended Posts

I want my Office back now.

I was updating the Office2016 to correct the email issue I was having.  Anit-ransomware detected something during the update and said it was moving it to the quarantine.  I rebooted and there is nothing in quarantine and none of my office products works or is locatable on my system.  I need this to work this is now costing me money I cannot afford to lose....CheckResults.txtlogs (2).zip

Malwarebytes Anti-Ransomware (2).zip

Link to post
Share on other sites

Yes, I have repaired my office applications, all of them that disappeared.


I have looked through the MBAMSERVICE log and have found where ARW detected the threat  @ 07:46:04.948

 07:46:04.948 812578 AntiRansomwareControllerImpl Received threat detection callback from ARW SDK, ObjectPath=C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.6568.2036\OfficeClickToRun.exe, MD5=8582c451302eaa2a834077412717b200730cd2741c7b61d587f4f0139a94d0fd  07:46:04.950 812593 MbCommonSigVerify   Opening C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.6568.2036\OfficeClickToRun.exe for verification  07:46:04.950 812593 MbCommonSigVerify   File Not Found - 2          07:46:04.951 812593 AntiRansomwareControllerImpl Error calculating file hash info        07:46:04.952 812593 AntiRansomwareControllerImpl Error getting file size        07:46:04.952 812593 AntiRansomwareControllerImpl Error calculating file hashes        07:46:04.953 812593 AntiRansomwareControllerImpl The detected file is NOT whitelisted, sending an action request to the SDK to kill this process. ObjectPath=C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.6568.2036\OfficeClickToRun.exe.  07:46:05.359 813000 AntiRansomwareControllerImpl Received a results callback from ARW SDK - ObjectPath = C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.6568.2036\OfficeClickToRun.exe, ActionTaken=ARW_ACTION_KILL_THREAD, Result = ARW_RESULT_SUCCESS, RebootRequired = No  07:47:45.160 912796 AntiRansomwareControllerImpl Anti-Ransomware protection has been stopped.  

​Notice the three 3 errors of ARW that resulted in the Killing of the ClicktoRun process.  Also notice that there is no log entry for the file moving to Quarantine.  I am not sure what your code is but this looks like a place to start.


I have placed the file C:\Program Files\Common Files\Microsoft Shared\ClickToRun on the exclusion list.  Will this allow the ClicktoRun to be successful next time.


Do you have a list of f​ixes like the Reference: Repair an Office application, if so where are they located?


I look forward to hearing from you.

Link to post
Share on other sites

Hello geezer50:


It's good to read of the successful restoration!


"Please keep in mind that this is the first beta and there may be some bugs or issues that need to be worked out, so we encourage you to try it out in a non-production environment first." -Marcin Kleczynski, Chief Executive Officer, Malwarebytes Corp.

The very first public beta was just publicly announced on January 25th. Many would advise that a Beta release should never be installed on production computer systems. The most cautious may even wait till MBARW has been rolled into Malwarebytes' release products.


Do you have a list of f​ixes like the Reference: Repair an Office application, if so where are they located?


I am sorry but no. I simply remembered and sought the solution you might require with Google.


The MBARW Beta development team will analyze the logs you and other beta testers submitted for resolutions.


Thank you for your interest in MBARW Beta, and your valued feedback.

Link to post
Share on other sites

Thanks, that is about what I did in the end, but it took a while to get there.  Has anyone looked at the service logs.  I have been monitoring them daily and it looks like there is an hourly request for updates but so far there have been no updates.  Periodically ARW sends reports to Malwarebytes but I have not been able to see what is in the report.

Link to post
Share on other sites

  • Root Admin

If  you're having issues with the beta and require assistance with repair then I would suggest removing the beta. Then perform a System Restore back to before you installed the beta and it should return your computer back to the exact same way it was before you installed the beta.



Thank you

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.