moetee Posted September 17, 2020 ID:1408205 Share Posted September 17, 2020 After Malware Bytes required an update and a new install of that update. Every time I open Excel, I get this message, Viewing the report shows it as: Is this real or what? What do I do? Link to post Share on other sites More sharing options...
Porthos Posted September 17, 2020 ID:1408221 Share Posted September 17, 2020 53 minutes ago, moetee said: Is this real or what? What do I do? Probably a FP. Having your post moved to the correct section. Link to post Share on other sites More sharing options...
moetee Posted September 17, 2020 Author ID:1408222 Share Posted September 17, 2020 1 minute ago, Porthos said: Probably a FP. Having your post moved to the correct section. What do you mean probably a FP? Link to post Share on other sites More sharing options...
Porthos Posted September 17, 2020 ID:1408223 Share Posted September 17, 2020 Just now, moetee said: What do you mean probably a FP? What were you doing exactly at the time? Link to post Share on other sites More sharing options...
moetee Posted September 17, 2020 Author ID:1408225 Share Posted September 17, 2020 This happened after I installed an update with Malware Bytes. Link to post Share on other sites More sharing options...
Porthos Posted September 17, 2020 ID:1408226 Share Posted September 17, 2020 Just now, moetee said: This happened after I installed an update with Malware Bytes. No, were you just opening the excel program or a spreadsheet. Link to post Share on other sites More sharing options...
moetee Posted September 17, 2020 Author ID:1408228 Share Posted September 17, 2020 2 minutes ago, Porthos said: No, were you just opening the excel program or a spreadsheet. Whoops, yes that's exactly right. Whenever I open Excel I get these popups. Why is this happening? Link to post Share on other sites More sharing options...
Porthos Posted September 17, 2020 ID:1408229 Share Posted September 17, 2020 Just now, moetee said: Why is this happening? 13 minutes ago, Porthos said: Probably a FP. Having your post moved to the correct section. There have been a few reports of this. That is why I asked for your post to be moved to the exploit section. Link to post Share on other sites More sharing options...
moetee Posted September 17, 2020 Author ID:1408230 Share Posted September 17, 2020 5 minutes ago, Porthos said: There have been a few reports of this. That is why I asked for your post to be moved to the exploit section. Ok but who can help me with this? Link to post Share on other sites More sharing options...
Porthos Posted September 18, 2020 ID:1408248 Share Posted September 18, 2020 2 hours ago, moetee said: Ok but who can help me with this? Wait until your topic gets moved by an admin and then you will get help. Lets do a clean install and see if it fixes it. Please do the following Uninstall and reinstall using the Malwarebytes Support Tool Please have lots of patience with the tool. The first phase is a cleanup and does require a Windows Restart. After the Restart, it may take 2 - 3 - 4 minutes till the Support tool screen shows up. Please be patient and have faith. Wait for it, whatever it takes. The 2nd phase is where it offers to do a new Install. Let me know if that clears up the issue or not. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 18, 2020 Root Admin ID:1408260 Share Posted September 18, 2020 Hello @moetee Let us get some logs please. Please follow the instructions from the following KB article. Upload Malwarebytes Support Tool logs offline Thank you Link to post Share on other sites More sharing options...
moetee Posted September 18, 2020 Author ID:1408275 Share Posted September 18, 2020 2 hours ago, AdvancedSetup said: Hello @moetee Let us get some logs please. Please follow the instructions from the following KB article. Upload Malwarebytes Support Tool logs offline Thank you Ok here it is. I downloaded that program, ran it and went through the questionnaire of the Dashboard and I should've read the article first but then mid way into what I think it was doing (maybe cleaning) I cancelled it because you asked for logs. I then looked for the MWB icon and it was gone so I guess it was deleted. I then went to Advanced window and clicked on Clean and followed everything and rebooted and it reinstalled MWB for me. Then all my historical logs/notifications were erased and when I opened Excel.exe it worked. The logs are attached though. So how did a new install make MWB think Excel.exe is not a virus? mbst-grab-results.zip Link to post Share on other sites More sharing options...
exile360 Posted September 18, 2020 ID:1408277 Share Posted September 18, 2020 A new build was just released today. It's possible that in doing the clean install, you actually got the latest version installed for the first time and it may have had a fix for the Excel issue. That's just speculation on my part however, just based on the timing. Link to post Share on other sites More sharing options...
moetee Posted September 18, 2020 Author ID:1408278 Share Posted September 18, 2020 3 minutes ago, exile360 said: A new build was just released today. It's possible that in doing the clean install, you actually got the latest version installed for the first time and it may have had a fix for the Excel issue. That's just speculation on my part however, just based on the timing. The excel.exe issue happened when I installed that new release earlier this morning though. Also did a full scan and nothing found....so weird. Why is MWB not detecting this though? Link to post Share on other sites More sharing options...
exile360 Posted September 18, 2020 ID:1408279 Share Posted September 18, 2020 This detection is from one of the behavior based real-time protection components. Those components cannot be used in the scan as scans are just based on threat signatures and traditional heuristics. The Exploit Protection component is responsible for the Excel detection. Link to post Share on other sites More sharing options...
moetee Posted September 18, 2020 Author ID:1408280 Share Posted September 18, 2020 Just now, exile360 said: This detection is from one of the behavior based real-time protection components. Those components cannot be used in the scan as scans are just based on threat signatures and traditional heuristics. The Exploit Protection component is responsible for the Excel detection. Right. But, when I open Excel.exe it doesn't detect it. How do I know if its enabled or not ? Link to post Share on other sites More sharing options...
exile360 Posted September 18, 2020 ID:1408283 Share Posted September 18, 2020 You can right-click the tray where you should see it list Exploit Protection as being on. Link to post Share on other sites More sharing options...
moetee Posted September 18, 2020 Author ID:1408374 Share Posted September 18, 2020 9 hours ago, exile360 said: You can right-click the tray where you should see it list Exploit Protection as being on. Yup. It's checked. Link to post Share on other sites More sharing options...
Staff Arthi Posted September 18, 2020 Staff ID:1408439 Share Posted September 18, 2020 Hi moetee, Thanks for your logs. Can you please disable this setting marked in red. You should find it in Exploit Settings->Advanced settings. This is not one of the recommended default settings that is turned ON. It can result in false detections like in this case. Thanks. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now