Malwarebytes 3.0 blocking MS Office 365

[Daervon]

As the topic says, the new version of Malwarebytes is blocking my Microsoft Office apps (Version 1612 (Build 7668.2074)) from starting giving the error:

Exploit automatically blocked
Malwarebytes detected and blocked an exploit. It is no longer a threat to your computer.
Affected Application: Microsoft Office Word (though it also blocked Excel and the other office apps)
Protection Layer: Application Hardening
Protection Technique: Exploit blocked by Bottom-Up ASLR Enforcement

Let me know if I need to attach any other piece of information.

Please fix

[Norwian]

Same problem here with Office 2016 (Excel, PowerPoint and Word) and giving the same error.

I solved the issue in Protection > Advanced settings > Uncheck BottomUp ASLR Enforcement option in MS Office column.

As it is checked by default, I don't know if  Office is totally secure now.

Using MB 3.0.6.1469.

Some advice would be appreciated.

[dont_touch_my_buffer]

9 hours ago, Norwian said:

I solved the issue in Protection > Advanced settings > Uncheck BottomUp ASLR Enforcement option in MS Office column.

As it is checked by default, I don't know if  Office is totally secure now.

I don't know, if the office could be "totally secure", but...

Address space layout randomization, or ASLR, had been part of the Windows OS since Vista but disabled by default. Later versions of Windows do have ASLR enabled by default. Enabling the ASLR enforcement in MWB may have presented a conflict with Windows enforcement of the ASLR that prevented Office 2016 from starting up.

As long as one ASLR working, your Office 2016 is reasonably secure, provided that standard security practices exercised in addition layered security protection.

[Norwian]

Thanks @dont_touch_my_buffer for your reply.

Does it mean that the ASLR Enforcement option should  be unchecked for MS Office in later windows OS versions?

 

 

[trout]

i have a similar problem. i just updated malwarebytes and it is now blocking MS Word from loading. i get a message reading:

Exploit automatically blocked
Malwarebytes detected and blocked an exploit. It is no longer a threat to your computer.
Affected Application: Microsoft Office Word 
Protection Layer: Application Behavior Protection
Protection Technique: Exploit payload process blocked.

What do i do to be able to resume working on my book and to remain protected from malware? PLEASE HELP ASAP!!!!

THANKS SO MUCH FOR ALL HELP!!!!

[nikhils]

Hello @Daervon , @trout

This is a known issue with Anti Exploit and the MBAE team is actively working on it. For now the best bet would be to exclude the MS applications from Protected Applications list.

This will not compromise your protection against Malware in any way.

Thank you,

[trout]

Thanks so much Nikhil. Do you know how i can exclude MS word for the protected applications list? Thanks!

[trout]

i did it! Thanks so much dcollins! i can't see your post on this site, but i did get your email. Thanks you all so much!!!!

[ScottShuford]

Same thing here.  Fixed using the turn off suggestion above. My office version is Current Channel, Version 1703 (build 7967.2139). MBAE is Premium 3.0.6. I'm currently on the phone with MS tech support and they have no record of a conflict between MBAE and this version of Office, but we just proved it....

What is the status of my protection now that the MS Office related products are turned to OFF in the Protected Applications area? 

[Firefox]

12 hours ago, ScottShuford said:

What is the status of my protection now that the MS Office related products are turned to OFF in the Protected Applications area?

That would mean that your office products are not fully protected and are vulnerable to exploits...

[ScottShuford]

Thx FireFox! I was tired when I wrote that so yes of course, if it's off, it's not on, righto!  What I should have posted was is any additional information on this being fixed since the last few weeks when the previous poster hit the page?  I would think incompatibility with MS OFFICE would be a high priority fix... 

[Firefox]

I read in another post yesterday I believe that they were two weeks out on a fix...

 

[ScottShuford]

Awesome. THX AGAIN Firefox.  Following that thread now too. I'll probably post about it on my social this weekend. Will have to look up the best tags to include.  As I mentioned, Microsoft's techs didn't have this listed in their own databases.  I figured it out myself while in my 4th hour of tech support at just before midnight last night.  The MS tech and I replicated it across all Word and Excel at least twice before we hung up.  

 

[trout]

i hope they actually fix the problem and not spread it to other programs!!! i would like to have protection from documents that i download. Thanks ScottShuford for following up on this!

 

[ScottShuford]

Trout - absolutely.  

[Firefox]

To all following this thread... they have a new beta out now that addresses issues with MS Office... you may want to try it out...

 

[trout]

I'm a little nervous trying out a beta version because I don't know how to fix anything if something goes wrong. Does this beta test version overwrite the version that i bought? what is the downside of waiting for all you folks to test it out? If it works for you, please tell me. I simply can't afford to lose more time dealing with this. i'm a writer, and if i can't write, i don't get paid.

Please let me know what you think makes the most sense. i appreciate the helpfulness of this forum immensely!!! 

[nikhils]

Hello @trout

You can install the Beta version over your existing licensed version of the Malwarebytes 3.x product.The License will get forward without any issues.

This version has been tested well internally and has a lot of performance improvements.

My recommendation would be to go ahead and install the Beta product.

If you do run into issues we can always help to troubleshoot.

Thank you,

[ScottShuford]

Seems to be working so far.  I've been able to save from Word and Excel.  Haven't tried a mail merge again yet. 

For those who are installing the update, remember to turn back on the protection for the Microsoft Office applications IF you turned them off with the previous installation as the only fix available at that time.  

[nikhils]

Hello @ScottShuford

Thanks for confirming.

Best,

[Norwian]

On 7/2/2017 at 9:18 AM, Norwian said:

Same problem here with Office 2016 (Excel, PowerPoint and Word) and giving the same error.

I solved the issue in Protection > Advanced settings > Uncheck BottomUp ASLR Enforcement option in MS Office column.

As it is checked by default, I don't know if  Office is totally secure now.

Using MB 3.0.6.1469.

Some advice would be appreciated.

No changes with MB 3.1.0.1716,

I have to uncheck BottomUp ASLR Enforcement MS Office option in Anti-Explit settings (checked by default) in order make office to start.

With that option cheched MB gives me this error:

And office does not start up (not background in task manager).

Same with Word and PowerPoint.

Windows 10 1703 15063.250 (64 bits).

Office 2016 Pro Plus 16.0.4498.1000 (32 bits).

Is that the correct way to configure MB?.

Thank in advance for your comments.

 

[dcollins]

Can you please follow the instructions below to grab your logs so we can see what's getting blocked? This isn't the same issue that 3.1 fixed, as this looks like an active exploit block.

1. Navigate to C:\ProgramData\Malwarebytes\MBAMService
   • ProgramData may be hidden. If so, you will need to type the path manually or turn on showing hidden files/folders
2. Right click the logs folder and choose Send to -> Compressed (Zipped) folder
3. This will create a file named logs.zip on your desktop. Please upload that file in your reply

[Norwian]

Thanks dcollins for your quick response,

After my last post I did a clean reinstall of MB 3.1.0.1716. MB did not ask for reboot, updated and with the default settings all office apps started up fine.

But after a reboot Office did not start up (as described in my last post). Unchecked the BottomUp ASLR Enforcement MS Office option and problem solved.

Attached requested files,

logs.zip

[Norwian]

Is there any new info about that issue?

[Norwian]

After a clean install of MB 3.1.1 Beta (no reboot) Office 2016 apps start up fine with default MB settings.

After reboot, Excel, Word and PowerPoint does not start up and MB gives the message described in #21.

Then unchecked the BottomUp ASLR Enforcement MS Office option and the apps started up as usual.

Any info about the logs files I sent on Tuesday?

MB package version 1.0.117

Edited May 4, 2017 by Norwian
Add information