Malwarebytes 3.6.1 Premium blocks Word/Excel 2013

[rborland]

Malwarebytes 3.6.1 Premium is blocking Word/Excel 2013. Windows 10 show the following message:

     The operating system is not presently configured to run this application

Quitting Malwarebytes allows these applications to run normally.

I attach the support logs.

I would appreciate any advice.

mbst-grab-results.zip

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab
   
    
7. Click the Gather Logs button
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
    
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

I discovered the following entries in your logs which may indicate an issue with your Office installation and that may be why this is happening:

Pending File Rename Operations
==================================
C:\Program Files\Microsoft Office 15\ClientX64\Centennial.Detection.IsCentennialOfficeInstalled.scratch
C:\Program Files\Microsoft Office 15\ClientX64\Centennial.Detection.IsCentennialOfficeInstalled.scratch
C:\Program Files\Microsoft Office 15\ClientX64\Centennial.Detection.IsCentennialOfficeInstalled.scratch

I would suggest trying to reinstall Office to see if that helps, then be sure to check for any available Microsoft Updates to get Office fully patched and up to date.

Once that is done, go ahead and try launching your MS Office programs again to make sure that Malwarebytes no longer interferes with them.

Please let us know how it goes and if the issue still persists.

Thanks

[rborland]

Thanks for the helpful suggestion.

Before posting my message I uninstalled and reinstalled MS Office 2013 from my original licensed CD several times. I also ran the online repair routine. None of this solved the problem.

Both applications worked fine with the previous version of MBAM.

[exile360]

OK, thanks.  Have you installed all the updates for your version of Office through Windows Update/Microsoft Update?  If not, then that's worth a try as well (and it's also important to install such updates anyway for the sake of security).

[rborland]

Thanks for the suggestion. I'm up to date with Windows 10 and Office updates.

[exile360]

OK, good.  Please try disabling each individual protection component in Malwarebytes to test and see which one might be causing the issue.  I would suggest starting with Exploit Protection as that's the most likely culprit in this case.  You may disable each by right-clicking on the Malwarebytes tray icon and clicking on each one, one at a time, then testing to see if your Office apps will launch, and if they don't, then disable the next protection component until you've tested all 4 of them.

If it still doesn't work even with all 4 protection components disabled, then open Malwarebytes and navigate to Settings>Protection and toggle the Enable self-protection module to Off under the Startup Options section then test to see if they are able to launch.

Please let us know how it goes.

Thanks

[rborland]

That's a very good diagnosis. Disabling Exploit Protection solves the problem.

[exile360]

OK, great, thanks for the information.  Now hopefully we can correct the problem so that you are able to use your MS Office applications with Exploit Protection enabled.  It is very likely that disabling shielding for these individual applications would correct it, however I'd feel better if we could do something that wouldn't potentially compromise your protection for those applications so we'll try some other things first to see if any of them help.

First, I noticed that you are also running Bitdefender.  It is possible that there is some kind of conflict going on causing this to occur on your system, so to eliminate that as a possibility, please try temporarily disabling Bitdefender and see if you are then able to launch your MS Office apps with Exploit Protection enabled in Malwarebytes.  If so, then creating exclusions for Bitdefender in Malwarebytes and for Malwarebytes in Bitdefender may solve the problem, so let me know if that helps and I'll provide some info to help you configure exclusions.

[rborland]

Another good call! With Exploit Protection enabled in MBAM and Protection Shield disabled in Bitdefender Free MS Word runs normally. I'd appreciate your advice on how to enable mutual exclusions.

[exile360]

OK, excellent, that means that (hopefully) fixing this issue shouldn't be too difficult, assuming exclusions do in fact correct it as I hope they will.

So first off, to exclude Bitdefender from Malwarebytes, open Malwarebytes and navigate to Settings>Exclusions and click the Add Exclusion button, leave the Exclude a File or Folder option selected and click Next, then click the Select Folder... button and browse to the location where the primary program folder for Bitdefender is located (most likely C:\Program Files or C:\Program Files (x86)) and select the Bitdefender folder and click on OK, then do the same for its data folder (most likely C:\ProgramData\Bitdefender or something similar).

Once that's done, open Bitdefender and locate its option for excluding applications or processes from its Protection Shield/real-time protection and exclude as many of the items listed in this support article as you are able to (don't worry if you can't exclude some of the items such as the .sys/driver files, but do exclude them if you are able to).

As soon as those steps are completed, try running your Office apps to see if they now function correctly with all of your protections in both products fully enabled, and if not, try restarting your system as the products might just need to reload for the exclusions to take full effect.

Please let me know if that solved the problem or not.

Thanks

[rborland]

For clarification, when adding exclusion to Bitdefender, is it sufficient to simply exclude the Program Files\Malwarebytes folder without adding individual paths to exe files?

[exile360]

As long as the items are being excluded from its real-time protection/Protection Shield component then yes, it should be sufficient to just exclude the paths.  I'm just not sure if it works that way or not as many AVs only allow excluding individual files/applications from their protection components (unlike Malwarebytes) and only allow excluding folders from their scanning components.  But if it does work like Malwarebytes does for its exclusions, then yeah, that would be much easier/simpler.

[rborland]

So in Malwarebytes I set exclusions for the following folders:

  C:\Program Files\Bitdefender
  C:\Program Files\Bitdefender Agent
  C:\Program Files\Bitdefender Antivirus Free

and in Bitdefender I set exclusions for the following folders:

  C:\Program Files\Malwarebytes

I restarted the system but Word/Excel will not run.

[exile360]

OK, it sounds like perhaps Bitdefender isn't fully excluding it somehow.  It may be one of the drivers listed in that support article I linked to, in particular mbae64.sys which is the driver used for Exploit Protection in Malwarebytes.  It also may help to exclude C:\ProgramData\Malwarebytes from Bitdefender, so you might also try that.

Also, please make certain that the interface you're using to exclude items in Bitdefender does apply to the Protection Shield component because as I mentioned previously, many AVs separate exclusions for the on-demand scanning component and their real-time protection.

It also may help to exclude Bitdefender's data folder if it has one (most likely located under C:\ProgramData).

[rborland]

Thanks for the further advice but the C:\ProgramData and C:\System32 folders do not show when trying to set exclusions in Bitdefender. The C:\System32 folder does not even appear in File Explorer (with hidden items view enabled) on this Windows 10 system.

I can't be sure about the scope of the exclusions in Bitdefender as the Free version I'm using does not have the same configuration granularity as the paid versions. I will see if I can find out.

In the meantime I am quite happy to disable the exploit protection in MBAM temporarily whenever I need to use Word/Excel.

[exile360]

Oh, it's C:\Windows\System32, not C:\System32 (though I don't know if that helps any as Bitdefender still may not allow excluding that individual file, and you should absolutely not exclude that entire folder as it is a location frequently used by infections when they install on PCs so it does need to be monitored by your security software).

[exile360]

By the way, one more thing you should verify is that you're running the latest version of Bitdefender as this may be an issue they've fixed in a recent release.  I'm not sure what the procedure is to check for new program versions in the product, but you should be able to see what the latest version is on their website and compare its version info to the one you have installed, and if yours is outdated, go ahead and download and install the newest version then restart your system and see if it helps.

[rborland]

Of course it's C:\Windows\System32 (blush) . . . so I have added the following exclusions to Bitdefender:

C:\Windows\System32\drivers\mbam.sys
C:\Windows\System32\drivers\mwac.sys
C:\Windows\System32\drivers\mbamswissarmy.sys
C:\Windows\System32\drivers\mbamchameleon.sys
C:\Windows\System32\drivers\farflt.sys
C:\Windows\System32\drivers\mbae64.sys

Note that 

C:\Windows\System32\drivers\mbae.sys

Does not appear on my system.

Still Word/Excel will not run.

 

[rborland]

I'm pretty sure I'm running the latest Bitdefender, it updates itself every hour or so.

[exile360]

Just now, rborland said:

I'm pretty sure I'm running the latest Bitdefender, it updates itself every hour or so.

It might just be updating signatures/detection databases and may not be checking for/downloading full product/program version updates/upgrades (many AVs do it this way since usually the user has to interact with the installers for new versions manually and generally requires a system restart, so it's not something that can be accomplished silently/automatically in the background).  Again, I don't know for certain how Bitdefender does it, but I do know that most of the security products I've used throughout the years, including most of the AVs, have generally kept program updates/update checks separate from the regular/frequent database updates, and many of them don't check for new versions at all and may or may not offer a button or option to manually check for new program versions.

[rborland]

OK, noted, will check and get back to you.

[Alterfritz]

I have the exact same problem. Malewarebytes exploit protection protection is blocking Word and Excel from loading. After turning it off all is well. I spent 3 days reinstalling Office and in general going crazy until I saw this thread on Google. Hey Malewarebytes, fix your screw up please. Files attached.

mbst-grab-results.zip

[rborland]

I have found that you can re-enable MBAM exploit protection once Word/Excel are running which reduces the time your system is unprotected. It would be nice to have a proper fix for this problem.

[exile360]

You may also follow the instructions in my post here so that you may disable Exploit Protection just for the affected MS Office applications rather than your entire system that way your browsers and other processes will still be protected.