Jump to content

False Positive - OfficeClickToRun.exe


Recommended Posts

Been running the beta for a couple of weeks now with no issues (or reports).  This morning I received a "Ransomeware Detected" message for OfficeClickToRun.exe.  From what I have seen this is a process that Office 365 needs/uses.  I do have Office 365 installed.  It said the action completed was Moved to Quarantine, yet when I go look at the Quarantine, it is not there.  Unsure if it actually did the action it reported.

Link to post
Share on other sites

Hello phantomx2005 and :welcome:

Please create the following archives for developer analysis:

Create a ZIP archive of the directory C:\ProgramData\Malwarebytes\Malwarebytes Anti-Ransomware\

Create another ZIP archive of the directory C:\ProgramData\Malwarebytes\MBAMService\logs\

Please attach the above zipped archives to your next reply.

Thank you.

Link to post
Share on other sites

It actually got worse.  I rebooted my computer and was getting shortcut errors when ever I ran any office product (Outlook, word, excel).  Did a repair and it all came back.  Unfortunately I uninstalled Anit-Ransomware to avoid this problem and it looks like it deleted the files you want me to send.  There is still a folder C:\ProgramData\Malwarebytes\Malwarebytes Anti-Ransomware\  but it only has about 10 files in it (all with a .arw extension).  the logs directory is gone.


I am tempted to re-install now I know that a repair of office fixed it but unfortunately I do not have the files to send (unless you want those .arw files still)

Link to post
Share on other sites

Hello phantomx2005:


If you are satisfied that all other applications, and your OS are functioning correctly, that's great. If you are then interested in continuing the Beta test of MBARW, please re-install it in a conventional manner. Before using any Microsoft Office applications, please "White List" the full pathname to the then present location of OfficeClickToRun.exe.


Thank you for participating in the MBARW Beta test program.

Link to post
Share on other sites

Hello @Josarn and :welcome:

It is disappointing to read your testing system is having MBARW Beta issues but each computer is unique. Problems that seem "the same" frequently are not.

The same is true for solutions. Solutions may often need to be individualized for your unique testing system.

It is less confusing for everyone if a "One Member Per Topic" policy is adhered to instead of posting to the topic of another member.

Development Team Members, Staffers and helpers will be able to more easily provide both you, and the OP/Topic Starter, with individualized assistance.

Please start a NEW, and SEPARATE topic by left-clicking this >>Start New Topic<< link now.

Thank you always for your patience and understanding.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.