Malwarebytes blocked an excel file from opening - AE

[Pedro14]

I raised this and in response I forwarded file to do with Malware Support tool  (mbst-grab-results.zip).

Have heard nothing back and wonder how long it takes for a response.

I need to open the excel file ASAP

[Porthos]

14 minutes ago, Pedro14 said:

Have heard nothing back and wonder how long it takes for a response.

If you opened a support ticket, It takes 5-7 week days for a response.

Please attach the zip file here for faster response so we can also determine what protection component is involved.

[exile360]

It may be the same issue described in the following threads; if so, it may require disabling one of the options in the advanced settings for Exploit Protection:

 

[Pedro14]

Have attached file

Exile260 thanks . It was a different message and I am not game to try and open I get this message

mbst-grab-results.zip

[TItan360]

I have the SAME problem with Office - XL, Word and PPT. None of them open and I get a message "Exploit ROP gadget attack blocked"

MWB is stopping me from getting into those apps! BUT - the scanner finds NOTHING! This looks like a bug in their SW!

I can't do my work! Can't de-install it either. (But if I do, is there REALLY a virus or not?) MWB is inconclusive. 

I submitted a ticket, and no response. DO THEY EVEN CARE? 

I call the help line (800) 520-2796 but it just refers me back here.

Time to start some sharing and feedback about this app - and their poor tech support! Maybe write an article. If that's how they treat customers!

[Porthos]

33 minutes ago, TItan360 said:

None of them open and I get a message "Exploit ROP gadget attack blocked"

Can you please disable this setting marked in red. You should find it in Exploit Settings->Advanced settings.

This is not one of the recommended default settings that is turned ON. It can result in false detections like in this case.

Thanks.

 

[Porthos]

39 minutes ago, TItan360 said:

I submitted a ticket, and no response. DO THEY EVEN CARE? 

Support tickets are running behind. It can take 5-7 days for a response other than the automated ticket number.

 

[Porthos]

41 minutes ago, TItan360 said:

I call the help line but it just refers me back here.

The number is not for consumer support. All consumer support is done here on the forums or with the help desk.

[TItan360]

So, we're supposed to not use our apps for 5-7 days?? Unreal. Offer premium support at a cost. I am running a consulting business!

I went in and unchecked the ROP exploit.

MS Office apps now work. however, who knows if I have a virus?? I also downloaded a new update. 

[TItan360]

Do I have to re-enable those disabled settings? 

[Porthos]

5 minutes ago, TItan360 said:

MS Office apps now work. however, who knows if I have a virus?? I also downloaded a new update. 

It is a false positive that is being worked on. It does not affect all users though. You are just one of the affected ones.

 

7 minutes ago, TItan360 said:

So, we're supposed to not use our apps for 5-7 days??

The forum is here for support and topics are answered quickly.

[Porthos]

6 minutes ago, TItan360 said:

Do I have to re-enable those disabled settings? 

 

21 minutes ago, Porthos said:

This is not one of the recommended default settings that is turned ON. It can result in false detections like in this case.

Just leave it off.

[AllHailShronk]

I've been having the same issue. All my MS office files are getting hit with that false positive too.

[exile360]

Please see if the instructions posted by AdvancedSetup here are helpful:

 

[Ried]

I did find Pedro14's ticket on the HelpDesk and assisted him.  It was indeed a false detection and advised him it was ok to open that file.

I had also found Titan360's ticket and replied to that.

[Hazardous544]

On 9/23/2020 at 7:46 AM, Porthos said:

Can you please disable this setting marked in red. You should find it in Exploit Settings->Advanced settings.

This is not one of the recommended default settings that is turned ON. It can result in false detections like in this case.

Thanks.

 

I came looking for a fix for this issue as well. Found this, thank you again.