SBCooke

[SBCooke]

I have Malwarebytes 3.0.6 (Lifetime license) installed on 4 different computers all running Windows 10 Pro. On one of these computers the Exploit protection feature is triggered each time I try to start MS Word or Excel (Office 2016). Message displayed is under Protection Technique: "Exploit ROP Gadget Attack Blocked".and under Protection Layer: "Protection Against OS Security Bypass". All of the computers have the same version of MS Office and most current Windows 10 Updates. All have the 4 Malwarebytes protection features/layers turned on. Any ideas as to what is going on?

[Porthos]

1 hour ago, SBCooke said:

I have Malwarebytes 3.0.6 (Lifetime license) installed on 4 different computers all running Windows 10 Pro.

Off topic...Same key or 4 different keys?

On topic

1. Hi everyone! If possible, can you please grab some information for us so we can look at what's going on?

   1. Open up Malwarebytes 3
   2. Go to Settings -> Application
   3. Turn on Event Log Data
   4. Restart the computer
   5. Open up Malwarebytes
   6. Verify that Web Protection is not turned on
   7. Attempt to turn on Web Protection
   8. Wait 2-3 minutes
   9. Zip up the folder C:\ProgramData\Malwarebytes\MBAMService\logs by right clicking the folder and choosing Send To -> Compressed (Zipped) folder
      Note that the ProgramData folder may be hidden. You may need to turn on Showing Hidden Files, or type the path manually

   Please upload the zip file that gets created (it should be on your desktop)

   Now please run mb-check, which can be downloaded from here: https://downloads.malwarebytes.org/file/mb3_check. Run this program, which will create a file on your desktop named mb-checkResult.txt. Please upload this file as well.

   And lastly, the FRST logs will help as well:

   1. Please download Farbar Recovery Scan Tool from here http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ and save it to your desktop.
      Note: You need to run the version compatible with your system.
      **After you click the Download Now 64-bit, or the Download Now 32-bit, another page will open — DO NOT CLICK ANY ADDITIONAL 'download now' buttons, just wait and look toward the bottom of your browser for the option to Run or Save. Click Save.
   2. Double-click to run it. When the tool opens click Yes to the disclaimer.
      Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
   3. Click the Scan button.
   4. When the scan has finished, it will save 2 logs  in the same directory the tool was run from.  Please attach the following logs:
      Addition.txt
      FRST.txt 

   I realize this is a lot of information to ask, but it should help us figure out what's going on. If you're able to help with the above instructions, there should be 4 files being uploaded. mb-checkResult.txt, FRST.txt, Additions.txt, zip file of logs folder

[SBCooke]

 This is late, but here are the results as requested by your staff. Problem still exists as of 3/13/2017 on my Dell Inspiron SFF Model 3647 with Samsung 512Gb SSD, 8Gb memory, i5 CPU.

Addition.txt

Exploit Blocker.txt

FRST.txt

LOGS.zip

mb-checkResult.txt

[dcollins]

@SBCooke it looks like CU3 hasn't been downloaded on this computer yet. Can you go to Settings -> Application and click Check for Application Updates to see if the update is available. If it's not, please download the latest version from here: https://downloads.malwarebytes.com/file/mb3