MB 3.0 - MS Word & Excel will not load

[wrcoke]

After loading Malwarebytes Premium (3.0). MS Excel and MS Word will no longer work/start/load. After clicking, it spins for several seconds and nothing, including no error message. This is consistent with MS Office 2010 and MS Office 2016. Uninstalling MB will solve the problem, looking for a permanent solution to continue using MB.

[Porthos]

5 minutes ago, wrcoke said:

After loading Malwarebytes Premium (3.0). MS Excel and MS Word will no longer work/start/load. After clicking, it spins for several seconds and nothing, including no error message. This is consistent with MS Office 2010 and MS Office 2016. Uninstalling MB will solve the problem, looking for a permanent solution to continue using MB.

 

 

The new beta fixes that issue.

Fixed issue with WMI protection technique in Exploit Protection that could cause Office applications to crash

 

Edited May 3, 2017 by Porthos

[wrcoke]

Much appreciated, will install the beta suggested.

[Porthos]

8 minutes ago, wrcoke said:

Much appreciated, will install the beta suggested.

Please post if you have any more issues.

[wrcoke]

I loaded the beta version using the provided link. I get the same result, except it now shows a popup block for both MS Word and MS Excel (blocks as exploit). I also ran a scan and it logged both apps as exploits in the Reports section. Now with the beta version, it blocks browsers Chrome, Foxfire and IE. Chrome will eventually show up, but will not work. With IE, it just spins a few seconds and never opens. Firefox is blocked as an exploit (popup) and also show up in the reports tab. I can turn off the Exploit option and all apps/browsers work as expected. 

[nikhils]

Hello @wrcoke

Here is what I would recommend.

1. Use MB-Clean to completely clean your machine : https://downloads.malwarebytes.com/file/mb_clean

2. Download the latest Beta 3.1.1.1722 build using the following post:

3. If you still continue to experience issues, please use the forum post below to get us the logs: Namely FRST.txt, Addition.txt and MB-CheckResults.exe

We can look at your logs and analyze what is going on.

Thank you,

[wrcoke]

Thanks, i will go through the steps above and let you know. 

[nikhils]

Great, Thank you.

[wrcoke]

I performed the recommended steps you provided above.  I get exactly the same results. MB see's MS Word and MS Excel as exploit and blocks them. 

All logs you requested did not exist on my machine. I am including all that were generated. 

mb-clean-results.txt

changes.txt

[dcollins]

When you say that Word and Excel are getting blocked, are you saying that you see a green exploit blocked notification? If so, then this is a different issue than the beta was designed to fix. Can you please provide a screenshot of your word add-ins by using the instructions from Microsoft below:

https://support.office.com/en-us/article/Enable-or-disable-add-ins-in-Office-programs-3e533d0f-a6cf-44b7-b6b4-3d9185b5e025?ui=en-US&rs=en-US&ad=US#bm1

Please also provide the following logs:

Create and obtain Farbar Recovery Scan Tool (FRST) logs

1. Download FRST and save it to your desktop
   1. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
2. Double-click to run and when the tool opens click Yes to the disclaimer
3. Press Scan button
4. This will product two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   1. Attach both of these logs to your post by clicking on the "Drag files here to attach, or choose files..." or simply drag the files to the attachment area

[wrcoke]

Yes, it shows the green exploit blocked notification on both MS Word and MS Excel. I will get you a screen shot of add-ins, but should be whatever might be loaded by Microsoft, since this is a fresh install of MS Office 2016. I'll complete the remainder, as suggested, and provide sometime tonight. Thanks!

[nikhils]

Hello @wrcoke

We are trying to get to the bottom of this from our end. It would be great if you could assist us with some additional debug logs.

Here are the instructions for the MB3.x product to get the debug logs:

1. Please download the files from this link:  https://malwarebytes.box.com/s/may9rp523cj22ebt6qr184sqfrf0jf7i

 

 2. Press the Windows + R keys, type "services.msc" and hit Enter.

 

 3. Find the service named "Malwarebytes service" and use the right click menu to stop the service.

 

 4. Extract the contents of the ZIP to a sub-folder in your Desktop.

    Copy the files mbae.dll and mbae64.dll and paste them to the C:\Program Files\Malwarebytes\Anti-Malware\ folder.

    Copy the files mbae.sys and mbae64.sys and paste them to the C:\Windows\System32\drivers\ folder.

 

 5. After you replace the files, start the "Malwarebytes service" service again or reboot the computer.

 

 6. Reproduce the problem and collect and send back to us these two files:

  C:\ProgramData\Malwarebytes\MBAMService\logs\mbae-default.log

  C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.log

 

The directory is hidden by default so you might have to click on "View -> Hidden items" in Explorer to see it.  

 

There is also a post here from Microsoft on how to do this for the more recent OS: https://support.microsoft.com/en-us/help/14201/windows-show-hidden-files

 

The debug logs will surely help us get to the bottom of the issue and fix it in subsequent builds.

 

Thank you

[wrcoke]

I will do this over the weekend and provide the requested logs. Thanks

[nikhils]

Much appreciated. Thank you @wrcoke

[wrcoke]

I've completed all instructions, reproduced the issue and attached the requested files. 

MBAMSERVICE.LOG

mbae-default.log

[nikhils]

Thank you @wrcoke for your help.

We will forward the logs to our Team for further analysis.

Best,

[nikhils]

Hello @wrcoke

Our developers have fixed the MS Office being blocked  issue in the MBAE stand alone build 1.09.1.1410

However this is still a standalone product and the fix has not into the latest MB 3.1.2.1733 public build.

We will integrate the fix with the next CU release of the MB 3.1 product which will be out soon. (I will ping you once the new CU is out for MB 3.1)

For now your best bet would be to just Uncheck the BottomUp ASLR Enforcement for MS Office under the Anti Exploit settings.

If you want to give the stand alone MBAE build a try please use the following build: https://malwarebytes.box.com/s/5m21bpjkvwwafuhswulx7jogvqrrxsn5

Thank you for your patience.

Best,

[wrcoke]

Excellent, a big Malwarebytes fan. Glad it has been resolved, or soon forthcoming. I will probably just uncheck enforcement for MS Office until the next CU release of MB 3.1.

Thanks for resolving!

[nikhils]

Glad we could help. Stay tuned for further updates.

Best,