Jump to content

Malwarebytes BLOCKED my Excel


tgouws

Recommended Posts

Yesterday at 4pm all my productivity stopped. Malwarebytes reported that Ransom ware was found on my PC.

Today, I cancelled everything - so I can spend the day to check my computer carefully.

Turned out that Malwarebytes BLOCKED my Excel thinking it is Ransome ware.

Now I can NO LONGER access my Excel files!

I tried to call Malwarebytes - but they don't answer on Saturday.

I am a premium Malwarebytes member.

To add insult to injury, I have checked online and saw that this issue has occurred multiple times since December 2019.

But I could not find solutions

VERY ANNOYED 

 

 

MalBug.png

Link to post
Share on other sites

44 minutes ago, tgouws said:

But I could not find solutions

Disable ransomware protection until the issue is fixed.

Quote

The Ransomware Protection component is the least proactive in Malwarebytes because it relies entirely on active application behavior in memory to make detections, meaning your system would first need to actually be infected by a live ransomware threat for Ransomware Protection to detect anything.  This is extremely unlikely since you still have the other more proactive components active which should prevent any infection from infiltrating your system in the first place, including ransomware.  I've kept Ransomware Protection disabled in Malwarebytes pretty much since it was first integrated due to performance issues and I have yet to experience a single infection event.

 

Link to post
Share on other sites

16 minutes ago, tgouws said:

Yes, it would be nice to know how remove 'blocks' that were placed in error.

Thank you.

Restart the computer.

Once the computer restarts open MB and toggle off just the ransomware protection and leave it off until the issue is corrected. 

 

2020-06-20_14h56_22.png

Link to post
Share on other sites

Thank you.

I did not think that turning that toggle off would apply to all previous threats that were blocked.

If turning ransomware protection off, re-activates all previous files that were block.

It would unblock Excel.exe which is good.

But then it would also unblock any real threats that also may have been blocked.

It would be nice to have the option to unblock one file that is in error, rather then all or nothing.

Link to post
Share on other sites

3 minutes ago, tgouws said:

But then it would also unblock any real threats that also may have been blocked.

The goal is to workaround the issue until it can be fixed. Ransomware just blocks activities that it thinks fit encryption processes and this process is being falsely stopped.

Like was said before.

Quote

The Ransomware Protection component is the least proactive in Malwarebytes because it relies entirely on active application behavior in memory to make detection's, meaning your system would first need to actually be infected by a live ransomware threat for Ransomware Protection to detect anything.  This is extremely unlikely since you still have the other more proactive components active which should prevent any infection from infiltrating your system in the first place, including ransomware. 

 

Link to post
Share on other sites

This occurred to me today as well.

 

I toggled ransomware protection off and was able to open excel.

Then I ran the support tool from the provided link in the previous message:

https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-offline

It did it's thing, updated my malwarebytes, and turned ransomware protection back on.

 

Scheduled scan tomorrow so we will see if it shuts excel down again.

 

I do find it odd that one would not be able to select ignore on a particular file for this.

Seems like that would be the easiest temp solution but I'm no programmer.

 

 

Link to post
Share on other sites

5 minutes ago, greylock23 said:

I don't know what to tell you. It updated my MB and my excel works fine now

If it works do not worry about unless it happens again.

 

4 minutes ago, greylock23 said:

Logs attached

I was working the above reply but you beat me to it.

Link to post
Share on other sites

Hello,

Thank you for the logs. This was indeed a false-positive that we intend on releasing a fix for as soon as possible.

In the meantime, if the issue does happen again, you may wish to add a folder exclusion for C:\Program Files (x86)\Microsoft Office\Office12 until the fix mentioned above is released.

Edited by LiquidTension
Link to post
Share on other sites

On 6/26/2020 at 12:00 PM, Porthos said:

@greylock23

I would suggest 2 things though.

First I would re-enable Windows Defender for added protection.

image.png.febe8bbeb58a5d72442f3a6427354041.png

I also suggest turning off fast startup in Windows. Then restart.

 

https://www.tenforums.com/tutorials/4189-turn-off-fast-startup-windows-10-a.html

 

Thanks for the tips! Do you mean switch it off then back on? When I flicked it off I got a pop up about not having virus protection turned on.

Link to post
Share on other sites

  • 1 month later...

It has done this to me 4 times.

 

I have since turned off Ransomware, put it as an Exception.

 

I have REPAIRED it and reverted to Previous Version (RESTORE) and reinstalled the Microsoft Certificate (Without having to reload program using Excel 2007) on a Windows 7 Professional Operating System.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.