Exploit Protection and Office 365

[nybbles]

I just installed the Office 365 Click-to-Run updates released on Sept. 12, 2017. Now MB3 3.2.2 with latest updates installed is immediately closing all of the Office applications and providing an exploit protection warning. See attached report.

Even if I disable the Office apps in Exploit Protection, it'll still detect it. I had to completely disable Exploit Protection in order to run any of the Microsoft Office applications. They are absolutely critical to my business. Please advise.

excel exploit.txt

[Porthos]

You turned them off in this section. Could you get us the following logs, please.

·  Create and obtain Farbar Recovery Scan Tool (FRST) logs

1. Download FRST and save it to your desktop
   Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
3. Press the "Scan" button
4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions

·  Create and obtain an mb-check log

1. Download MB-Check and save to your desktop
2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
3. This will produce one log file on your desktop: mb-check-results.zip
   • This file will include the FRST logs generated from the previous set of instructions
   • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

[nybbles]

Yes, it didn't help to turn off Exploit protection on just the Office applications in the screen you posted above. I can only run Word or Excel (didn't try the others) if I completely disable Exploit Protection.

As requested:

Note that FRST would not run unless I disabled Norton temporarily. I re-enabled Norton after FRST completed and prior to running mb-check.

Also, I re-enabled Exploit Protection on MB3 before running both FRST and mb-check.

Hoping this helps figure out what's going on.

 

mb-check-results.zip

Edited September 16, 2017 by nybbles
forgot to comment as to the screenshot.

[nybbles]

It just started working normally again... odd... maybe there was something funky in one of the "signature" updates???

[dcollins]

On 9/16/2017 at 1:00 PM, nybbles said:

It just started working normally again... odd... maybe there was something funky in one of the "signature" updates???

Exploit protection doesn't use signatures, so nothing on the MB3 side would have changed here. Let us know if the issue returns though, and we can look into it then

[nybbles]

ok... still working fine. No idea what was going on for those few hours... I didn't change anything... or even reboot...