PowerPoint does not work with MB 3.0

[FredGreco]

Since installing Malwarebytes 3.0, PowerPoint crashes on opening (multiple machines) if the Protected Application for PowerPoint is turned on. It took me about 3 days to narrow down the problem, but it is definitely MB 3.0. Turning off the Protected Application removes the crashing immediately. Turning it back on causes constant crash - and on multiple PCs.

Is there a fix planned?

[Rsullinger]

Hello FredGreco,

 

We have been seeing a few reports of this. Do you mind collecting some logs for our developers to take a closer look into this? 

I want to have you collect two logs from these directories after you trigger the alert again:

C:\ProgramData\Malwarebytes\MBAMService\mbae-default.txt

C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.txt

The directory is hidden by default so you might have to click on "View -> Hidden items" in Explorer to see it.   There is also a post here from Microsoft on how to do this for the more recent OS: https://support.microsoft.com/en-us/help/14201/windows-show-hidden-files

Along with that we want to collect some more information from the computer to see what else is installed. We want to rule out any conflicts. To do this:
 

1: Please download FRST from the link below and save it to your desktop:

http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

2: Double-click the purple FRST icon to run the program. Click Yes when the disclaimer appears.

3: Click the Scan button

4: When the scan has finished, it will make 2 log files in the same directory the tool is run, FRST.txt and Addition.txt. Please attach both files in your reply.

[FredGreco]

Logs from FRST attached. There is no txt file in that folder. I have hidden files shown, and I can see the folder. The only file in it is "MBAMSERVICE.LOG"

FRST.txt

Addition.txt

[Rsullinger]

Hello Fred,

 

Do you mind grabbing that log for me still? Also, if you are looking in the logs folder for the mbae-default, it will not be in that directory. It is just in the root  C:\ProgramData\Malwarebytes\MBAMService\  which is a bit different from the MBAMSERVICE.LOG

[FredGreco]

I'm still not sure I understand. You asked for these two logs/files:

C:\ProgramData\Malwarebytes\MBAMService\mbae-default.txt

C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.txt

I don't see any txt files there (as indicated above). There are .log files in those locations - mbae-default.log and MBAMSERVICE.log. I've attached those. Let me know if these are what you are looking for.

mbae-default.log

MBAMSERVICE.LOG

[Rsullinger]

Hello Fred,

 

That was my mistake. The log file type is different in the standalone version compared to mb3. However, thank you for those logs. I am getting this sent over to our development team to look into this further. Just as additional information from another thread, can you find what build of power-point you are on currently? We have been seeing reports of this happening on the latest version so I want to confirm that information from you. 

[FredGreco]

2 minutes ago, Rsullinger said:

Hello Fred,

 

That was my mistake. The log file type is different in the standalone version compared to mb3. However, thank you for those logs. I am getting this sent over to our development team to look into this further. Just as additional information from another thread, can you find what build of power-point you are on currently? We have been seeing reports of this happening on the latest version so I want to confirm that information from you. 

 

No problem. I have PowerPoint version 1611 Build 7571.2075 (which I believe is the latest).

[Rsullinger]

Hello Fred,

Thank you for the information. That is the report we have been seeing as well. I will update you when I get some more information from our development team on this.

[FredGreco]

On 12/15/2016 at 4:34 PM, Rsullinger said:

Hello Fred,

Thank you for the information. That is the report we have been seeing as well. I will update you when I get some more information from our development team on this.

 

This has not been fixed by 3.0.5, has it?

[Rsullinger]

Hello Fred,

 

That is correct. We have a fix for the issue that is currently being tested. So it was not able to make it into that 3.0.5 version. We should have more information on this soon. 

[Telos]

FWIW I'm not seeing this problem w/PP2013.

[Rsullinger]

Hello Telos,

 

That is correct. This is only happening with the new build of power point they put out. Users tested being on the last build of what office 365 pushed out and they do not get the issue. 

[Rimfaxe]

I have experienced the same issue running Windows 10 and Microsoft Office 2016 with Malwarebytes v2016.12.27.03

I uninstalled and reinstalled MS Office and get the same issue.  Microsoft support indicates that this is a problem with Malwarebytes.  Is there a fix for this?

https://support.office.com/en-us/article/Opening-PowerPoint-2016-with-Malwarebytes-3-0-you-get-a-Stopped-working-error-or-crash-72bee412-89d4-42e3-b7cb-15a33dbaa618

Edited December 28, 2016 by Rimfaxe

[Rimfaxe]

In the above post, Malwarebytes version is 2.2.1.1043.  I mistakenly put the db version.

[Rsullinger]

Hello Rimfaxe,

 

The 2.0 version of mbam shouldn't be having the same issue as the one reported here. Do you happen to have anti-exploit as well? If you do, can you verify what version of that you are currently on? 

[anders86]

Hey all,

I've been having this exact issue. Very frustrating, but Rsullinger, when you mentioned anti-exploit, that prompted me to look there. When I went to shields, and disabled the shield on powerpnt.exe, that seemed to make all the difference. Power Point starts perfectly fine, now. I'll post back later if it turns out to be premature celebration.

[RichardLowe]

Hello,

I am having exactly the same issue.

@anders86 your suggestion fixed it for me. Thanks!

 

Richard

[Rsullinger]

@anders86@RichardLowe

 

Are you both using the anti-exploit client by itself or the one in MB3. If you are using it by itself, do you mind testing and see if this build fixes the issue without needing to disable that?

 

https://malwarebytes.box.com/s/todtb6bhna0nq7c3v7z7mja8cl4xlxkv

[anders86]

@RsullingerThat build seems to work great. I'm using the anti-exploit client by itself (I'm using MB3 simultaneously, of course). I had to re-enable protection on powerpnt.exe, though. It migrated the old settings to keep it unchecked. Thanks! Can I do anything else?

[Rsullinger]

Hello Anders,

 

Not at this time. We will be updating the anti-exploit in MB3 to have this same version. However, since it is the beta build it may be a bit. Thank you for confirming it worked! 

[Acrobaze]

Hi,

It looks like the problem is  fixed with the new 3.0.6.

PowerPoint (Office 2016 Family and student) works fine, now, with the default settings.

 

[FredGreco]

3 hours ago, Acrobaze said:

Hi,

It looks like the problem is  fixed with the new 3.0.6.

PowerPoint (Office 2016 Family and student) works fine, now, with the default settings.

 

 

Is there a link to 3.0.6?

[Acrobaze]

1 hour ago, FredGreco said:

Is there a link to 3.0.6?

 

Yes, here it is :