prenup Posted August 31, 2021 ID:1477569 Share Posted August 31, 2021 I had the same prompt appear earlier for me. It was in Excel instead of Word, but everything else was the same! Is it safe to assume it's just because of the update that Porthos mentioned and nothing more serious? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 31, 2021 Root Admin ID:1477574 Share Posted August 31, 2021 We're investigating further to see what the root cause is @prenup Link to post Share on other sites More sharing options...
prenup Posted August 31, 2021 Author ID:1477616 Share Posted August 31, 2021 5 hours ago, AdvancedSetup said: We're investigating further to see what the root cause is @prenup Alright, I just wanted to be sure this isn't something I should be concerned about! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 31, 2021 Root Admin ID:1477661 Share Posted August 31, 2021 Hello @prenup If you can enable enhanced event logging from within Malwarebytes and then restart the computer and gather logs for us we can look further and see if we find any other issues. To begin, please do the following so that we may take a closer look at your installation for troubleshooting: NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system. Download the Malwarebytes Support Tool In your Downloads folder, open the mb-support-x.x.x.xxx.exe file In the User Account Control pop-up window, click Yes to continue the installation Run the MBST Support Tool In the left navigation pane of the Malwarebytes Support Tool, click Advanced In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply Thank you Link to post Share on other sites More sharing options...
prenup Posted August 31, 2021 Author ID:1477719 Share Posted August 31, 2021 Alright, I have attached the file here! mbst-grab-results.zip Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 1, 2021 Root Admin ID:1477757 Share Posted September 1, 2021 Thank you for the logs @prenup Do you have a macro in Excel that is calling cmd.exe ? That is what was blocked. If you want to continue to allow that to run then you'll need to keep WMI abuse disabled. @overclockable if you're having the same issue then turn off Office WMI abuse prevention as well. If you're possibly having some other issue then please gather the logs as requested above and post them back. Thanks Link to post Share on other sites More sharing options...
prenup Posted September 1, 2021 Author ID:1477775 Share Posted September 1, 2021 As far as I know I don't have any macros for Excel. I checked the file to be sure and there were no macros in it! I'm not sure what it was that happened then! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 1, 2021 Root Admin ID:1477801 Share Posted September 1, 2021 Did you launch Excel from a command prompt? "exploitData" : { "appDisplayName" : "Microsoft Office Excel", "blockedFileName" : "ComSpec=C:\\Windows\\system32\\cmd.exe", "documentFileName" : "", "layerText" : "Application Behavior Protection", "protectionTechnique" : "Exploit Office WMI abuse blocked", Link to post Share on other sites More sharing options...
prenup Posted September 1, 2021 Author ID:1477925 Share Posted September 1, 2021 I didn't, no. I'm just unsure as to where it would've come from. Now I am a little more concered. Was there anything suspicious in the logs I sent? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 1, 2021 Root Admin ID:1477932 Share Posted September 1, 2021 Let me have you run the following and we'll do some scans to make sure there isn't something there. @prenup The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. The download links & the how-to-run-the tool are at this link at Microsoft https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download Please let me know the results of this scan. The log is named MSERT.log the log will be at %SYSTEMROOT%\debug\msert.log which in most cases is C:\Windows\debug\msert.log Please attach that log with your next reply. Next, run the following scanner. but restart the computer first Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking. I would suggest a free scan with the ESET Online Scanner Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe It will start a download of "esetonlinescanner.exe" Save the file to your system, such as the Downloads folder, or else to the Desktop. Go to the saved file, and double click it to get it started. When presented with the initial ESET options, click on "Computer Scan". Next, when prompted by Windows, allow it to start by clicking Yes When prompted for scan type, Click on Full scan Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on the Start scan button. Have patience. The entire process may take an hour or more. There is an initial update download. There is a progress window display. You should ignore all prompts to get the ESET antivirus software program. ( e.g. their standard program). You do not need to buy or get or install anything else. When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”. Click The blue “Save scan log” to save the log. If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files” ( in blue, at the bottom). Press Continue when all done. You should click to off the offer for “periodic scanning”. Note: If you do need to do a File Restore from ESET please follow the directions below [KB2915] Restore files quarantined by the ESET Online Scanner version 3 https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner Thanks Link to post Share on other sites More sharing options...
prenup Posted September 1, 2021 Author ID:1477936 Share Posted September 1, 2021 I did a quick scan with the first one and it apparently found something and removed it. I will attach. I am currently doing a full scan with it to be throrough! msert.log Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 1, 2021 Root Admin ID:1477938 Share Posted September 1, 2021 That was just a setting that the Microsoft scanner found. It's not a real threat. I'm not expecting to find any issue so I'd suggest going ahead and running the ESET scan now @prenup Cheers Link to post Share on other sites More sharing options...
prenup Posted September 1, 2021 Author ID:1477951 Share Posted September 1, 2021 Alright, I did both scans, the only thing the ESET one found was a Norton thing? I do use Norton as antivirus, though. Not sure if the file it found is safe or not. scanlog.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 8, 2021 Root Admin ID:1483112 Share Posted October 8, 2021 Hello @prenup Very sorry for the delay. It looks like the system didn't alert me that you had replied. I was going through topics to close them and noticed your reply and that I had not replied to you. If you still need help please let me know Thank you Link to post Share on other sites More sharing options...
Recommended Posts