LibreOffice 7

[Granta]

No log (not via a scan), but reproduced by setting LO7 to start with windows.

Worked fine with LO 6, but LO 7 generates the following ...

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 09/11/2020
Protection Event Time: 11:28
Log File: a0028356-227e-11eb-be4d-f0bf97dbc171.json

-Software Information-
Version: 4.2.3.96
Components Version: 1.0.1104
Update Package Version: 1.0.32658
Licence: Premium

-System Information-
OS: Windows 10 (Build 19041.610)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Malware.Exploit.Agent.Generic, C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LibreOffice 7.0.lnk, Blocked, 0, 392684, 0.0.0, , 

-Exploit Data-
Affected Application: LibreOffice
Protection Layer: Application Behavior Protection
Protection Technique: Exploit payload macro process blocked
File Name: C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LibreOffice 7.0.lnk
URL: 

(end)

 

[Arthi]

Hi Granta,

Can you please send us this log file 

C:\ProgramData\Malwarebytes\MBAMService\logs\mbae-default.log

Thank you.

[Granta]

Enclosed. Ran the sequence again, so the latest occurrence should be at the end (start?) of the file.

mbae-default.log

[Arthi]

Thanks Granta for the log file. This bug has been fixed and is due to release in the next few days. It will be pushed out to Beta very soon.

Until then the workaround is to turn off the toggle for LibreOffice in the protected application list.

Thank you.

[FrenchFrog]

Same problem today 6th December 2020. When is this problem going to be corrected?

Malwarebytes False Positive.txt

[exile360]

Greetings,

It is possible that this has been fixed in the latest beta.  If you wish to try it and see, open Malwarebytes and go to settings by clicking the small gear icon in the upper right, then scroll to the bottom of the General tab and enable the option for beta updates and confirm that you want to enable beta updates when prompted, then scroll back to the top of the same tab and click the Check for updates button and allow it to download and install the new beta, restarting your system once the installation completes (even if you are not prompted to do so just to ensure that the new components are loaded into memory), then test to see if the issue is now corrected or not.

If you do decide to test the beta, please let us know if it resolves the issue for you or not.

Thanks

[FrenchFrog]

Same false positive with beta 4.3.0.98.

Malwarebytes False Positive.txt

[Porthos]

1 minute ago, FrenchFrog said:

Same false positive with beta 4.3.0.98

Open Malwarebytes and access settings by clicking the small gear icon in the upper right, then select the Security tab and scroll down to the Exploit Protection section then click the Advanced settings button and click the Restore Defaults button on the lower left, then click Apply and wait around 20 seconds for the protection to refresh, then test to see if Libre Office works.

[FrenchFrog]

Same problem.

[Porthos]

3 minutes ago, FrenchFrog said:

Same problem.

Quote

LibreOffice 6.4

I suggest updating to the current version of Libre Office.

https://www.libreoffice.org/download/download/

[FrenchFrog]

11 minutes ago, Porthos said:

I suggest updating to the current version of Libre Office.

https://www.libreoffice.org/download/download/

No way. I use only stable version. The problem come from Malwaresbytes, not from LibreOffice.

[Porthos]

Just now, FrenchFrog said:

The problem come from Malwaresbytes

Then it is time to do the following.

Please do the following Uninstall and reinstall using the Malwarebytes Support Tool

Please have lots of patience with the tool.  The first phase is a cleanup and does require a Windows Restart.
After the Restart, it may take 2 - 3 - 4 minutes till the Support tool screen shows up.   Please be patient and have faith.  Wait for it, whatever it takes.
The 2nd phase is where it offers to do a new Install.

 Let me know if that clears up the issue or not.

[FrenchFrog]

58 minutes ago, Porthos said:

Then it is time to do the following.

Please do the following Uninstall and reinstall using the Malwarebytes Support Tool

 

Please have lots of patience with the tool.  The first phase is a cleanup and does require a Windows Restart.
After the Restart, it may take 2 - 3 - 4 minutes till the Support tool screen shows up.   Please be patient and have faith.  Wait for it, whatever it takes.
The 2nd phase is where it offers to do a new Install.

 

 Let me know if that clears up the issue or not.

 

Same problem. I disable LibreOffice in protected apps section and I can now enable startup LibreOffice with Windows session.

[Porthos]

5 minutes ago, FrenchFrog said:

I can now enable startup LibreOffice with Windows session.

So am I to understand the above setting is what triggers this. I never set Libre Office to start with Windows.

[FrenchFrog]

10 minutes ago, Porthos said:

So am I to understand the above setting is what triggers this. I never set Libre Office to start with Windows.

Yes. Malwarebytes block this option and LibreOffice do not start with Windows.

[Porthos]

4 minutes ago, FrenchFrog said:

Yes. Malwarebytes block this option and LibreOffice do not start with Windows.

I would turn off that one setting. Windows and programs have enough starting at startup. It is an optional at install and an un needed setting.

I am sure staff will track this down and fix now that we know the exact source.

 

Edited December 6, 2020 by Porthos

[FrenchFrog]

This option speeds up the opening of LibreOffice documents and is useful.

[tomdkat]

I ran into this very issue today, with Malwarebytes 4.3.0.98 installed (the GA release).   So, is this something that will be fixed or is removing LibreOffice from the "protected apps" area the only solution?

Thanks!

Peace...

[FrenchFrog]

Copy the LibreOffice shorcut to your startup directory (Global or User). The shortcut must point to "C:\Program Files\LibreOffice\program\quickstart.exe". Modify shortcut property to start minimize. You can open user startup directory with the command line «shell:startup». This tip should solve your problem. 😉

[tomdkat]

1 minute ago, FrenchFrog said:

Copy the LibreOffice shorcut to your startup directory (Global or User). The shortcut must point to "C:\Program Files\LibreOffice\program\quickstart.exe". Modify shortcut property to start minimize. You can open user startup directory with the command line «shell:startup». This tip should solve your problem. 😉

Thanks for the info!  I get the Malwarebyyes Exploit block when I try to enable quickstart from within the LibreOffice options.   I'll give your tip a try.  Thanks!

Peace...