Office Apps

[TonyVerdoon]

I'm running Windows 10, patched from a long-standing Windows 7 installation.

I have a lifetime sub to MBAM and heard I could update to 3.0 by doing an install over. Seemed to work okay, but ever since, the Anti Exploit program won't let me open any MS Office files, either using Excel and Word or even Libreoffice. This is with a wide variety of files. If I turn off Exploit protection then it works as expected.

Being a curious monkey I went into Manage Protected Applications and I see that I can turn off protection on a per item basis, but I'm assuming that's not a good idea. 

Oh, I also created a custom listing for Excel to try out - how do I delete it? There's an option but apart from toggling protection On or Off, the delete option remains greyed out. 

This is the typical text of the Report, and I've attached my log file. Looking through the log file I'm seeing a lot of Warnings and Errors which seem to be related to json files - I don't have Java installed, if that makes a difference.

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 12/17/16
Protection Event Time: 5:48 PM
Logfile: exploit.txt
Administrator: Yes

-Software Information-
Version: 3.0.4.1269
Components Version: 1.0.39
Update Package Version: 1.0.772
License: Premium

-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Malware.Exploit.Agent.Generic, , Blocked, [0], [-1],0.0.0

-Exploit Data-
Affected Application: Microsoft Office Excel
Protection Layer: Application Hardening
Protection Technique: Exploit blocked by Bottom-Up ASLR Enforcement
File Name: 
URL: 

(end)

MBAMSERVICE.LOG

[John L. Galt]

What version of Office?  I have already been testing PowerPoint 2016  and it shows the same symptoms that you are describing.  Turning off the protection for PowerPoint allows it to work.

See

 

[TonyVerdoon]

It's Office 365, patched up to date. 

Thanks for the link. I've read through that other thread and at least the dev team is being made aware it's a bug. Guess I'll chill until it's patched.

[TonyVerdoon]

For what it's worth, the last patch seems to have sorted this out for me. Still curious how to delete a custom protection setting.

[Telos]

7 hours ago, TonyVerdoon said:

Still curious how to delete a custom protection setting.

I believe this is on the debug list. Neither Edit nor Delete buttons are functional at v3.0.5

[TonyVerdoon]

Oh, okay, thanks for letting me know!