office 2016 MBAM 3.0.6 and Office 2016 with Win10 Creator's Update

[Dragontech]

I just updated to the Creator's Update a couple nights ago and besides that one issue where MBAM disables Windows Defender, haven't had any trouble... or so I thought. Today when using Word (part of Office 356, latest version), it would hang/crash when I would try to save a document. I force closed it and tried again, same issue. This also occurred in Excel. I restarted, tried again, same problem. I uninstalled it then installed it again. No change. I even uninstalled the latest KB update I got late last night thinking that was the cause. I did a quick Google search about this issue and it seemed to be a common issue of which, MS released a patch for a while back, etc. I uninstalled it again, restarted, used CCleaner to clean the temps and reg and installed Office again. Same issue.... Word continued to freeze when going to "Save As." Just out of curiosity, I quit MBAM from running in the background via the typical icon in the system tray. I opened Word again and tried to save a document.... NO CRASH! I closed Word then opened MBAM again and waited until it enabled all of its' protection then opened Word again......... tried to save a document but as soon as I clicked on a folder to save it in... it got stuck. Sometimes, an error pops up after MS fails to find a solution.. in a small dialog box (attached.) 

Has anyone come across this issue yet?

Thanks,

Justin

[dcollins]

This is an issue with Anti-exploit that we've addressed in standalone Malwarebytes Anti-Exploit. The changes should get pulled into MB3 in the future. For now, you can disable the Office apps from being protected in MB3 -> Settings -> Protections -> Manage Protected Applications

[Dragontech]

Thanks @dcollins. I disabled them via your instructions and everything is good!

Justin

[SaveTheTiger]

On 4/13/2017 at 0:12 AM, dcollins said:

This is an issue with Anti-exploit that we've addressed in standalone Malwarebytes Anti-Exploit. The changes should get pulled into MB3 in the future. For now, you can disable the Office apps from being protected in MB3 -> Settings -> Protections -> Manage Protected Applications

Note this is also a problem when attempting to use "Smart Lookup" in Word 2016. Word does not crash with an error, it simply locks up until you end the process in Task Manager. Turning off Word as described will allow Smart Lookup to work properly. What protection am I losing by turning off Word in MB3 -> Settings -> Protections -> Manage Protected Applications?

Edited April 17, 2017 by SaveTheTiger

[zappozeppo]

Ten days ago I updated several PCs to Creators Windows 10 (1703) edition, and all users began unable to save within Office 2016 Word, Excel, PowerPoint.
It was a big problem, I spent a lot of time investigating on it, searching Internet, trying to repair, uninstalling, reinstalling Office with no results: all Office users were unable to operate (to save ...) their files.
Here is the solution: a bug in Malwarebytes Anti-Exploit protection.
I suggest MalwareBytes to quick disable by design MBAM 3.0.6 Office anti-exploit protection until update.

I would like to know, as SaveTheTiger asked before,

"What protection am I losing by turning off Word in MB3 -> Settings -> Protections -> Manage Protected Applications?"

Best regards

ZZ

Edited April 18, 2017 by zappozeppo

[dcollins]

When you turn off Exploit Protection for the listed applications, Malwarebytes will not be able to prevent those programs from being exploited. However the other protection modules should work to keep you safe by preventing the exploit from even reaching your machine (Web Protection) or stopping it if it does successfully launch (Malware Protection/Ransomware Protection)

[SaveTheTiger]

13 hours ago, dcollins said:

When you turn off Exploit Protection for the listed applications, Malwarebytes will not be able to prevent those programs from being exploited. However the other protection modules should work to keep you safe by preventing the exploit from even reaching your machine (Web Protection) or stopping it if it does successfully launch (Malware Protection/Ransomware Protection)

Thanks for the update dcollins. Do you know if there is a timeline on a permanent fix for this problem?

[zappozeppo]

On ‎19‎/‎04‎/‎2017 at 0:54 PM, SaveTheTiger said:

Thanks for the update dcollins. Do you know if there is a timeline on a permanent fix for this problem?

What we need, Devin, is to be somehow advised when you'll solve this problem, to re-enable exploit protection on Office applications or, of course, automatically re-enable these settings when updating MBAM.

Thank you in advance.

ZZ

[PCINME]

Yeah I have a flood of customers today calling me about this.  At least now I know what is going on and can apply the workaround on each machine.  Any idea of a timeline or having updates come in when things are ready would be super.

Just glad to not have to reinstall Office fruitlessly any more.

SA

 

[PCINME]

Just noticed this as well and thought I'd add it.  Office 2013 is also broken from this issue.  Not sure about any other versions.

 

SA

[MartinC]

If MalwareBytes are not going to fix this problem immediately please consider doing the right thing and emailing an alert advising people of the problem and the temporary workaround.

I, like I imagine others will, spent several hours trying to get critical processes running again that had a big impact on the business, reinstalling Office, trying to isolate the problem, eventually uninstalling the update, posting on forums (which in my case pointed me at MalwareBytes being the culprit).

Having now reinstalled the update, another hour, the workaround worked, it would have been good to know, saved a lot of time and made a problem a bit on a non-problem. 

[Davidhs]

Also on Win 10 Creator update and Office 365 and Word and Excel now work correctly as they did before Creator update.  

I still have the same save as problem in an image processing application despite adding it to the list and turning off the Protection, so problem is only partly resolved. 

While thanking DCollins for the temporary solution to this problem, I must add my voice to those pressing Malwarebytes to be more PROACTIVE on this and WARN users about the problem.  I used to have high confidence in Malwarebytes but that has taken a knock this weekend.

I have wasted a lot of time over the last two or three days wondering why I could not save perfectly ordinary Office and other files such as edited images to my preferred locations.  With particular large document I had been asked to comment on over the weekend this has been an immense frustration.   And I only discovered the Malwarebytes involvement by chance after much fruitless googling.

Malwarebytes: If this is your spec / code / walk-through / testing problem, you owe us all a substantial apology.   

And tell other possibly struggling users about this problem.  

[zappozeppo]

15 hours ago, Davidhs said:

Also on Win 10 Creator update and Office 365 and Word and Excel now work correctly as they did before Creator update.

Problem IS NOT SOLVED

I'm actually running Malwarebytes:

• MB version 3.0.6.1468
• Component pkg 1.0.103
• Update pkg 1.0.1802

If I re-enable Exploit protection on Microsoft Office Excel, PowerPoint, Publisher and Word, saving a file from these applications hangs them and you need to force close them.

Disabling Exploit protection again, solves as before.

• Windows 10 Pro v1703 b15063.138
• Office 2016 v1701 b7766.2076

Regards

ZZ

Edited April 25, 2017 by zappozeppo

[dcollins]

This is correct @zappozeppo, the issue is not fixed in MB3 yet. We have fixed the issue in standalone MBAE and will be pulling those changes into MB3 in our next release.

[PCINME]

9 hours ago, dcollins said:

This is correct @zappozeppo, the issue is not fixed in MB3 yet. We have fixed the issue in standalone MBAE and will be pulling those changes into MB3 in our next release.

This is excellent news, any idea of a timeframe for this?

[dcollins]

I don't have a definitive timeline at this time, although we are trying to get it out as soon as we can.

[Firefox]

21 minutes ago, dcollins said:

I don't have a definitive timeline at this time, although we are trying to get it out as soon as we can.

An update was pushed out pretty quickly to address the Windows Defender bug in the Creators update.....

I think its very important to roll out an update to address the Microsoft Office Bug, as having folks disabling protections leaves them/us unprotected from possible exploits.  This also includes the bug with 32bit browsers.... its not always feasible to install a 64bit browser....

[dcollins]

I'm not in charge of pushing the button for a new release, so I can't speak to specifics about that. However I can say that our teams monitor activity closely, and we are always watching for new issues and weighing the pros/cons of when to release vs how much testing needs to be done. 

[norcalnative707x]

This must be a Priority One level fix.  If the problem is fixed in MBAE already, surely there is not much more to do to correct MBAM itself?

I love MBAM and recommend it to everyone.  However, this issue has seriously damaged my confidence in the program and Malwarebytes the company.  We're looking at two weeks already, and the problem will become a disaster very shortly as Creators Update rolls out to more and more users.  I manually updated to CU, because I'm technically adept, but most folks are not.

I was working in Word last night, and only discovered the problem when Word locked up during an attempt to save.  It took me about two hours to figure out the problem, after reinstalling Office and looking around online when that didn't work.  Fortunately, I found a link on the Microsoft forums to this thread.  I turned off Word protection as instructed in post 2, and everything's fine again, except for the lack of protection.  But that's not the primary issue; it's the fact people are going to run into a very frustrating and crippling problem that is not intuitively correctable.

Edited April 27, 2017 by norcalnative707x

[David-B]

11 hours ago, dcollins said:

I don't have a definitive timeline at this time, although we are trying to get it out as soon as we can.

I thought that the built-in exploit protection in MBAM3 was modular and could be updated without the need to push an entirely new release? (similar to how the malware definitions get updated all the time without a new release)

[pbust]

We're two weeks away from the next scheduled release for MB3, but we'll be discussing an emergency AeSdk-only Component Update tomorrow. Please stand by and thanks for your patience.

 

[norcalnative707x]

On 4/26/2017 at 10:44 PM, pbust said:

We're two weeks away from the next scheduled release for MB3, but we'll be discussing an emergency AeSdk-only Component Update tomorrow. Please stand by and thanks for your patience.

 

Thanks for letting us know!

I had to assist another MBAM user with this problem yesterday.

[michaeljbrown]

Hi, I've just spent the last 5 hours uninstalling and reinstalling Office 365 and pulling my hair as Excel kept crashing when I was trying to save existing files.  Finally I came across this post, once I turned off MB all saved fine!   Please fix this issue ASAP.

Cheers

[norcalnative707x]

4 hours ago, michaeljbrown said:

Hi, I've just spent the last 5 hours uninstalling and reinstalling Office 365 and pulling my hair as Excel kept crashing when I was trying to save existing files.  Finally I came across this post, once I turned off MB all saved fine!   Please fix this issue ASAP.

Cheers

Exactly my concern about a not-immediate fix.

MB staff: if an immediate fix is not technically possible, for whatever reason, how about a mass-email to all MBAM users alerting them to the problem, and the temporary fix pending the real fix?

It wouldn't reach everyone, but it would mitigate some of the countless hours wasted - and frustration experienced.

[bobmitch]

Too late for me!!  I was in the middle of a phone call with a client, writing script for a campaign coming up.  Went to save my Word document after three pages.  Word froze...locked up...got the message that "Word is no longer functioning"  Word 2016 closed and when re-opened...my three pages were still there...two were garbled...but was able to save page 1.  MB staff...this is ridiculous.  After reading this, I understand what the problem was...shame!