MS Office 2013 Blocked/False Error Message

[HollyCarmichael]

Greetings to All,

It's December 15, 2018. I have had both Malwarebytes Premium and Microsoft Office 2013 installed on my laptop which runs on the Windows 10 OS and for several years these they have worked fine together. I don't use all of the components of Office Suite every day, including Word, Excel and Powerpoint. What I use the most is Publisher. However, it comes necessary to run the other three components from time to time. I can't say how long it's been since I ran them, but probably not longer than a month for Word and maybe longer for Excel and PowerPoint. 

OK ... the problem: Earlier this week, I tried to open a Word document and then the Word itself ...each time I got an error message saying "The operating system is not configured to open this program". I tried Excel and PowerPoint and the same thing happened. But MS Publisher worked fine.

The window in which the error message popped up was not a windows window, it was not an error message from Office either. It turns out, this was NOT what was wrong and NOT why the programs wouldn't run. What was wrong WAS the exploit protection was blocking them and so, I'm guessing it was a generic error message from Malwarebytes? Maybe. I don't know why the other components of Office 2013 were unaffected, but the fix was to turn off the "Exploit Protection" option in my MalWarebytes Premium.

I have worked to fix this for three days...only to discover this no-brainer fix... including three complete uninstalls and reinstalls, redoing configurations galore and also working on compatibility stuff and legacy settings all to no avail. WHY? Because the error message false and misleading.

I am very unhappy with this problem. I have to keep my settings in Malwarebytes compromised in order for my office components to run.

Holly

 

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab
   
    
7. Click the Gather Logs button
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
    
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

Yes, there appears to be an issue with Exploit Protection and some MS Office installations.  There is a thread about the issue here with some additional details as well as instructions on a workaround (disabling protection for the specific MS Office applications being blocked).

It may also be possible to disable even less protection if we can determine which specific protection aspect is affecting the programs in question.  If you wish to try, you may re-enable Exploit Protection and open Malwarebytes and navigate to Settings>Protection and click on the Advanced Settings button under the Exploit Protection section and using the checkboxes in the various tabs in the advanced settings interface, try disabling each one by one until you discover which specific protection is at fault and then leave all the others enabled so that you don't lose those other shields/protections.

Here is are images of what the interface looks like with its default settings (the last tab of settings is specific to Java and is unlikely to affect any MS Office applications):

[HollyCarmichael]

Greetings,

Thank you everyone for your replies! I am ready to fix this problem. Staff, please note when I ran and created the attached log just now, the option for anti-exploit was disabled.

Looking forward,

Holly Carmichael

mbst-grab-results.zip

[HollyCarmichael]

Greetings Exile 360 and Malwarebytes,

I have tried the various options mentioned above in order to discern if it is a single component or a combination of one or more components of the exploit protection in Malwarebytes. I am sorry to report that unchecking and applying none of the combinations or single components enabled me to open Word 2013. It's only when I turn off the exploit protection with the main buttons that I can open it. So, it appears the blockage is in the bundle somewhere.

I uploaded a log on Sunday morning, and have not heard word back yet from Malwarebytes above. I am looking forward to a resolution to this issue. I really want to use my Malwarebytes Premium to its fullest as I have in the past. 

At least we have narrowed it to some extent to a two month time frame and process of elimination as suggested by Exile 360.

Thanks again, I look forward to your replies and responses.

Holly Carmichael

[exile360]

Hello again,

What happens if you open Malwarebytes and go to Settings>Protection and click Manage Protected Applications and toggle the option for Microsoft Office Word to Off?  Are you then able to enable Exploit Protection without Word being blocked?

[HollyCarmichael]

Wow, Exile 360!

Yes, that did the trick. So, now I can have exploit protection on everything except those programs with Office 2013. Much safer, thank you so much.

I would like to add that deselecting them was laboriously slow... apparently it's an intense operation of Malwarebytes.

I hope that Malwarebytes will come up with a fix soon. But for now, I feel much better.

Thanks again, Holly

[HollyCarmichael]

Hey there, Exile 360,  One more thing... how can my Office 2013 programs get infected now? Have I disable ALL Malwarebytes protection for them? I have haven't I. SIGH. Thanks...Holly

 

[exile360]

Basically the only way those applications can get infected would be if you were to open a specially crafted malicious MS Office document like an infected MS Word doc containing an exploit from a malicious/spam email etc.  You don't have to worry about anything being exposed to the web like through your browsers or anything like that because your browsers are still fully protected/shielded.

Also, with regards to the process being slow to turn off individual app protection, yes, this is expected.  It's because the way Exploit Protection works is to inject a DLL into the shielded processes/applications for monitoring purposes so that when an exploit attack is attempted, it sees it happen and can stop it in its tracks before the exploit can successfully execute.  When you turn it off it has to unload that DLL from memory/from those processes which takes a bit of time (similar to stopping a service or driver that is running in memory).

[HollyCarmichael]

exile360, That's what I was thinking...thank you for verifying that... Now, I hope Malwarebytes will get back to me after having sent that log... I'd like the protection to be able to be turned back on. 

Have a great day,  Holly

[exile360]

You're welcome

@nikhils can you please take a look? (nikhils is a member of Malwarebytes Support who has been analyzing this issue).

[HollyCarmichael]

Thanks Exile 360. 

Hoping for a fix, Holly