Jump to content

Exploit Office WMI Abuse Blocked

Go to solution Solved by AdvancedSetup,

Recommended Posts

I've just got this when trying to open a .docx file of mine to resume writing and malwarebytes's rtp gave me this. This has never happened before. I was able to open the file normally on my second attempt, with the only difference being that Word said it wasn't able to start normally the last time and asked if it should run in safe mode, to which i clicked no and it opened normally.

I ran a full system scan with MBAM and my AV and nothing was detected. My PC is overall fine. No crashes, slowdowns or anything negative.

Is this something i should be concerned about?


Exploit Blocked.txt

Link to post
Share on other sites

  • Root Admin
  • Solution

Hello @xDanGRS

Please try the following and let us know if that corrects the issue or not.

Open up the Malwarebytes program and click on the cogwheel top right
Click on the "Security" tab
Scroll all the way to the bottom to the Exploit Protection settings and click the Advanced Settings button
Click the "Application Behaviour Protection" tab and scroll down to "Office WMI Abuse Prevention" and uncheck the box under "MS Office"
click "apply"


Thank you


  • Like 1
Link to post
Share on other sites

@Porthos @AdvancedSetup

Hello! The issue only happened once. I've opened over a dozen .docx files since the first occurrence and the issue haven't presented itself again. I only made a thread because i never came across something like this and wondered if i should be concerned or not.

I did disabled it in Application Behavior Protection regardless, however.

I am glad to know it's not anything serious. I appreciate the help!

  • Like 1
Link to post
Share on other sites

  • 4 weeks later...
  • 1 year later...

Just had the same, and Lost hours of work.
Was Copying Lots of Data between Excel and Text editor when this Popped up
and It Immediately Shut down Excel with the last changes to all my Data Lost.

Open Excel back up, and Even the Auto Saved files were gone.
everything for the past two or three hours is gone.
Even the recovered documents shows nothing to recover.

What is this and why did it not Prompt for an Action?


Screenshot (1748).png

Screenshot (1749).png

Link to post
Share on other sites

3 hours ago, wyldanimal said:

What is this and why did it not Prompt for an Action?

The following will NOT bring your work back but will keep that specific activity from being blocked as an exploit from happening again.

It is the same advice given to the original poster of this topic in 2021.

Please go to settings, security tab, and advanced settings in the exploit section and uncheck the following.


Edited by Porthos
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.