Jump to content

MBAE false positive with Microsoft Word


Recommended Posts

Every time I try to close or save a Word document I have created, MBAE triggers and says it has just blocked an exploit attempt.  MBAE has triggered 5 times so far. It should be a false positive since i'm the one that created the document.

I am using Microsoft 365 Apps for Enterprise with Windows 10 x64 Version 2004.

Who do I send the log files to?


Link to post
Share on other sites

4 minutes ago, Porthos said:

You can wait for a researcher to address this thread or you can create a support ticket and wait due to the long response time.


Thank you. I will wait a few days longer, and if I don't get a response I will create a support ticket. I use to just send these reports to pbust. I'm not even sure what they have him doing these days. I've been away for a while since I only used Linux for 2 years.

Link to post
Share on other sites

4 hours ago, AdvancedSetup said:

You can send me a Private Message with the logs attached. @cutting_edgetech


Upload Malwarebytes Support Tool logs offline

Thank you


It says a Macro is triggering the behavior protection. I checked in the Macro options under Word and I did not see any Macros listed. The Enterprise Office installation i'm using was provided to me by my University. Each time I save a Word document it automatically saves a copy to Microsoft One drive. Maybe it is using a Macro to save a copy of my document to Onedrive. I'm just taking a stab in the dark.

I'm sending you the entire Appdata folder, which contains the logs. Which log files do you normally request? Thank you!


Edited by AdvancedSetup
Log removed per request
Link to post
Share on other sites

I keep making post that do not post to the thread. I will try this once again. Please delete my logs from my post once you get what you need. I accidentally attached them to the post. Also, will I ever get editing rights to my post? I have been a member for a long time, and I can not make any changes to my post. I would just remove them myself if I was able, and send them by pm.

Link to post
Share on other sites

  • 5 weeks later...
  • 3 weeks later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.