FALSE POSITIVE? MALWAREBYTES EXPLOIT MESSAGE FOR MICROSOFT WORD 2010

[taipan1949]

TODAY, i STARTED GETTING POP-UP MESSAGES FROM MALWAREBYTES OF "EXPLOITS AUTOMATICALLY BLOCKED" FREQUENTLY WHEN i CLOSED VARIOUS WORD DOCUMENTS. HOWEVER AFTER RUNNING SCANS, I FOUND NO ISSUES AT ALL.

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab on the left column
   
   
    
7. Click the Gather Logs button
   
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
   
    
9. Upon completion, a file named mbst-grab-results.zip will be found on your Desktop. Click OK
   
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
    
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

[taipan1949]

4 minutes ago, taipan1949 said:

TODAY, i STARTED GETTING POP-UP MESSAGES FROM MALWAREBYTES OF "EXPLOITS AUTOMATICALLY BLOCKED" FREQUENTLY WHEN i CLOSED VARIOUS WORD DOCUMENTS. HOWEVER AFTER RUNNING SCANS, I FOUND NO ISSUES AT ALL.

i JUST TRIED TO DOWNLOAD THE MALWAREBYTES SUPPORT TOOL, THEN i GOT A MESSAGE STATING "REPAIR PROCESS INCOMPLETE.AND THEN "PRODUCT INSTALLATION WAS CANCELLED. I HAVE NO IDEA WHAT I NEED TO DO NOW.

[taipan1949]

I also just discovered that my malwarebytes program was deleted from my computer. Yikes

[exile360]

Greetings,

It sounds like the tool was attempting to uninstall/reinstall the product but got stuck at some point which is why Malwarebytes was not reinstalled on your system.  You may download the latest version from here and install it manually and hopefully the issue you were experiencing will be resolved, but please let us know if it is not.

Thanks

[taipan1949]

exile360, I followed your suggestion and installed Malwarebytes manually. However  i GOT that MESSAGE STATING "REPAIR PROCESS INCOMPLETE.AND THEN "PRODUCT INSTALLATION was cancelled again. So I tried a different tact leading to this file......(see attached below)

mbst-grab-results.zip

[exile360]

You shouldn't need to run the Support Tool any more if you were just trying to remove/reinstall Malwarebytes.  It looks like Malwarebytes is installed again according to your logs.  Are you still experiencing the exploit block issue with closing Word?

[taipan1949]

exile360 Yes! I still get pop-ups from Malwarebytes after I have attempted to close various Microsoft Word Documents. For example, I will pull up Document A and then try to close it, Another blank document will suddenly appear behind it (and on the top of this blank page I see "Document A") Then the blank doc disappears followed by the "Exploit Automatically Blocked" message popping up. But yet again the exploit block issue does not always occur on the same document. It is not consistent. By the way, I already contacted Microsoft Tech Support and they ruled out any problem from their end.

[exile360]

Understood, thanks.  I've asked for someone from the staff to take a look at this thread and assist.  Hopefully they will be able to get the issue corrected for you.

[taipan1949]

Today I decided to try uninstalling and reinstalling Microsoft Word 2010, but only observed the same problem again and again. So I reread each of the "Exploit Automatically Blocked" Malwarebytes messages and they all said that the cause was stemming from something called "Application Hardening, Bottom-up ASLR Enforcement." So I then went to my Protection Settings, then Anti-Exploit Settings and unchecked the MS Word box, then hit Apply. Problem solved if it was just a false positive issue from the getgo.