Jump to content

MB "Exploit Blocked" Disables MS Excel


LN108
 Share

Recommended Posts

Hello,

Since the recent update of my MB Premium, I cannot run Excel.  The program is shut down by MB with the message "Real-Time Protection detected and blocked an exploit attempt."  (Screenshot attached, report copied below.)

I've added Excel.exe to my allow list. No effect. I've gone to the Settings > Security > Advanced settings > Application behavior and unchecked Office WMI Abuse Prevention.  No effect. 

I've run the "Gather Logs" function of the MB Support Tool.  Zip file attached.

Advice appreciated. 

Lance

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 9/2/21
Protection Event Time: 8:29 AM
Log File: 7d7721c0-0c02-11ec-b6df-00ff0a912664.json

-Software Information-
Version: 4.4.5.130
Components Version: 1.0.1430
Update Package Version: 1.0.44523
License: Premium

-System Information-
OS: Windows 10 (Build 19043.1165)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Malware.Exploit.Agent.Generic, , Blocked, 0, 392684, 0.0.0, ,

-Exploit Data-
Affected Application: Microsoft Office Excel
Protection Layer: Malicious Memory Protection
Protection Technique: Exploit code executing from Heap memory blocked
File Name:
URL:

 

(end)

MB Exploit Blocked with Excel.png

mbst-grab-results.zip

Link to post
Share on other sites

  • Root Admin

Hello @LN108

Sorry for the delay. Let me have you do the following clean removal and reinstall of the program.

Then let me know if  you're still having an issue with Excel getting blocked.

 

 

Can you please do the following?

  • Download the Malwarebytes Support Tool
  • In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
  • In the User Account Control pop-up window, click Yes to continue the installation
  • Run the MBST Support Tool
  • In the left navigation pane of the Malwarebytes Support Tool, click Advanced
  • In the Advanced Options, click the CLEAN button and follow the onscreen instructions to reinstall Malwarebytes
  • NOTE: Please have patience as it can take a while to remove and reinstall. The computer will restart to complete

 

Thank you

 

Link to post
Share on other sites

Hello Admin,

Before I do this (clean uninstall, etc.), may I report that I subsequently to my message starting this tread, I found that the problem may not be connected with Excel, or with MS Office, at all--but rather with an MS Office add-in: AddinTools Classic Menu for Office.  Having deactivated this add-in, the problem seems to be resolved. See also a related entry in this forum, linked below.

I do want to continue using this add-in.  So my question is: How can I get MB to ignore it; I've been using it for years and it seems safe enough.

Thanks!  Lance

 

Link to post
Share on other sites

OK, so it ran the MB Support tool, as instructed.  Went back to Excel it was working fine--until I activated the AddInTools Classic Menu plugin and tried to do a "Save as" with a file.  That triggered a Exploit Blocked from MB, and the program shut down.  It's the "Save as" that reliably triggers this response.

Ideas appreciated!  Thanks, Lance

 

MB Exploit Blocked with Excel Again.png

Link to post
Share on other sites

  • Root Admin

Please open Malwarebytes, go to Settings, General, and enable the Enhanced logging. @LN108

Then run the plugin or whatever steps you took to duplicate this block or alert and then grab me new logs, please.

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Download the Malwarebytes Support Tool
  • In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
  • In the User Account Control pop-up window, click Yes to continue the installation
  • Run the MBST Support Tool
  • In the left navigation pane of the Malwarebytes Support Tool, click Advanced
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
  • A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

 

Link to post
Share on other sites

  • Root Admin

Thank you @LN108

Please open Malwarebytes, go to Settings -> Security tab -> scroll to the bottom and click the "Advanced settings" button.
Then click on the "Advanced memory protection" tab and turn off "Malicious return address detection" for "MS Office " and hit Apply.

image.png

image.png

 

Thanks

 

 

 

Edited by AdvancedSetup
updated information
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.