Exploit Protection Blocking Office 2003

[DanR77]

Win 7 Pro x64; MB 3.3.1 x64

MB 3.3.1 Exploit Protection blocks Office 2003 components (Word, Excel) from opening.  If Exploit Protection is turned off, Office 2003 Word, Excel work just fine.  Once Word and/or Excel are open, EP can be turned on and Word and/or Excel will open files just fine from within the apps.

Note 1: I have two Win 7 Pro X86 platforms with MB 3.3.1 x86 and Office 2003 that do not have this problem. only the x64 platform has this problem.

Note 2: A short while ago today, I used MBClean successfully to remove and re-install MB 3.3.1 x64 after experiencing the "Web protection will not turn on" problem for the first time this morning when the x64 platform first booted up. The driver file mwac.sys was mysteriously missing, presumably causing the web protection would not turn on issue. The successful MBClean exercise resolved this issue.

Upon working on unrelated task, I then ran into the Exploit Protection blocking Office 2003 issue. I remembered running into this issue a few weeks back on this same x64 platform but, being otherwise preoccupied at the time I did not follow up on it, and subsequently forgot about it - until today. Sigh.

And, yes, I searched the forum but could not find anything. Presumably this issue has been seen before and resolved?

[Porthos]

12 minutes ago, DanR77 said:

Exploit Protection blocks Office 2003 components (

Let's try and get some logs first so the team can review them and see if they can tell what may be causing your issues....

1. FIRST: Create and obtain Farbar Recovery Scan Tool (FRST) logs
2. Download FRST and save it to your desktop. Tell any program that blocks it to ignore or allow. It IS SAFE. It contains no info that can identify or harm you.
3. NOTE: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
4. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
5. Press the "Scan" button
6. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   NOTE: These two files will be collected by the MB-Check Tool and added to the zip file for you
7. NEXT: Create and obtain an mb-check log
8. Download MB-Check and save to your desktop
9. Double-click to run MB-Check and within a few second the command window will open, then click "OK"
10. This will produce one log file on your desktop: mb-check-results.zip
11. Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

[DanR77]

Attached are the requested log filed.  Hope they contain something useful.

Forgot to  mention: The blockage of Word and Excel 2003 is indicated as:

Affected Application: Microsoft Office Word (same for Excel)
Protection Layer: Protection Against OS Security Bypass
Protection Technique: Exploit ROP gadget attack blocked

mb-check-results.zip

[Porthos]

36 minutes ago, DanR77 said:

Attached are the requested log filed.  Hope they contain something useful.

First never change either the compatibility or the Run as Admin flags to Malwarebytes.

Quote

C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe    REG_SZ        ELEVATECREATEPROCESS

I don't remember if EMET has issues with MB and I also see there are some bit defender drivers loaded as well

Quote

S3 avc3; C:\Windows\System32\DRIVERS\avc3.sys [1605376 2016-11-18] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [285240 2016-08-29] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [878072 2016-11-18] (BitDefender)

 

I will let @dcollins look this over.

[DanR77]

46 minutes ago, Porthos said:

S3 avc3; C:\Windows\System32\DRIVERS\avc3.sys [1605376 2016-11-18] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [285240 2016-08-29] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [878072 2016-11-18] (BitDefender)

Interesting, Porthos.

I have never had BitDefender installed on this system, so those drivers should not be there?

[Porthos]

7 minutes ago, DanR77 said:

I have never had BitDefender installed on this system, so those drivers should not be there?

After some research, I see that viper uses their engine.

Have you added exclusions for MB in Viper?

I would like you to add these files to your Anti-Virus exclusions list as mentioned in this FAQ HERE (my list below includes the exe files as well)
 

• C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
• C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant
• C:\Program Files\Malwarebytes\Anti-Malware\mbamwow.exe
• C:\Windows\system32\Drivers\farflt.sys
• C:\Windows\System32\drivers\mbae64.sys
• C:\Windows\System32\drivers\mbam.sys
• C:\Windows\System32\drivers\MBAMChameleon.sys
• C:\Windows\System32\drivers\MBAMSwissArmy.sys
• C:\Windows\System32\drivers\mwac.sys

 

Also please exclude the following folders too: (The complete folder)

• C:\Program Files\Malwarebytes\Anti-Malware
• C:\ProgramData\Malwarebytes\MBAMService

[DanR77]

Ah, Viper uses the BitDefender drivers? That explains why they are present on all systems, with the same time stamp, and loaded at start-up per Sysintermals' Auto Runs. Learned something today. Thank you!

Yes, I have the 6 MB driver files excluded with Vipre, along with C:\Programs Files\Malwarebytes and C:\ProgramData\Malwarebytes folders, on all systems.  I will add the exclusions for the MB exe files also.

Am I correct in  thinking that these exclusions will prevent Vipre from interfering with these processes running in memory?

[dcollins]

It should prevent the interaction yes. After adding the exclusions is the problem still present?

[DanR77]

Yes, the problem is still present after adding the exclusions.

[dcollins]

Any chance you can try removing VIPRE entirely and then rebooting, just to see if the issue goes away?

[DanR77]

Is there a specific reason you are pointing at Vipre?  I did completely shut down Vipre (easy to do). It made no difference -  Excel and Word are still blocked.

I have been able to capture images of the popups that MB generates to inform me it is blocking Word 204 and Excel 300s ad "exploits"

 

It seem rather clear to me that MB is doling the deed, for whatever reason.

[dcollins]

I'm targeting VIPRE because we aren't seeing this issue being reported by others, which means it's most likely a software compatibility issue on your machine. The biggest cause of those issues is generally other security software.

That being said, can you try the following:

1. Press Windows Key + R to open the Run dialog
2. Type winword /safe and click Ok

Does the issue still happen?

[DanR77]

Sadly, yes. The issue of MB blocking MS Word as an exploit still occurs. Ditto for Excel /safe also.

[dcollins]

Do you have Grammarly installed on your system by chance? I see a mention of it in your logs, but don't see it in the list of installed programs.

[DanR77]

No, not that we can recall.  Not sure why we would since Word has its own built in functionality.  In any case, I did not find any instances of Grammerly in the system registry.

[DanR77]

Update:  I did a full clean uninstall of Vipre AS and rebooted.  MB 3.3.1 is still blocking Word and Excel, 2003.

I tried clicking on an RTF, a Word, and on an Excel file.  In all cases, this message popped up in the center of the screen (referencing the appropriate file), in addition to the MB Block Popup in the UL corner of the screen.

Hope this may help.

[dcollins]

Can you please try uninstalling Malwarebytes and installed the standalone Anti-Exploit from the following link. Then see if your issue goes away?

https://malwarebytes.box.com/s/acy2qdeus7ss1om4qvpsc358c777ymc8

[DanR77]

I think the problem is solved.

The mbae installer flagged EMET as an incompatible application that must be uninstalled before installing mbae. I exited the mbae install as I could not proceed with it.

I found an old out of date EMET version 4.x present. After uninstalling EMET, I resurrected MB 3.3.1 and tried Excel and Word. They now open and run flawlessly!

Just to be sure, I rebooted the system, verified MB and Viper running smoothly side by side, and and tried Excel and Word 2003 again. Flawless start and run.

I think this case can be closed. Note: I never did install mbae. I believe it's functionality is present in MB 3.3.1.

I have newer versions of EMET on some of my other systems. I'm thinking now would be a good time to remove them.

[Porthos]

On 1/7/2018 at 5:05 PM, Porthos said:

I don't remember if EMET has issues with MB

I thought so since MB has some of the same functionality. 

[dcollins]

Thanks for following up with us

[DanR77]

You're welcome, dcollins. And thank you for bearing with me. I learned a few things and have, I think, better systems as a result.

I found and removed EMET from two other x86 systems it was installed on. It did not appear to be conflicting with MB 3.3.1 on either of those systems. However, I swear that all 3 systems are now running a little bit smoother and faster with EMET gone.