.xls macro triggers exploit after MBAM updated today

[MrJBK]

Everything was working fine, then bang, another update (to ver 4.4.6) last week, and the same workbook was trapped as an exploit (see log txt file).

I beg to differ with your diagnosis regarding reset to defaults (in the link you provided above).  I tried it... RET ROP detection is off and it still triggers an exploit.Adding the macro worksheet to the "allow list" does nothing.  MBAM still crashes excel when macros1.xls load

he only way to make it stop is to disable 
"Office VBE7 abuse prevention"  and 
"Excel Macro 4.0 abuse prevention"

MBAM excel macro workbook blocked.txt

[AdvancedSetup]

Hello @MrJBK

Yes, that is correct. Please reset all back to DEFAULT settings. Then uncheck as shown as you found already.

 

Open Malwarebytes, click the small gear on the top right and go to the Security tab.
Scroll down to the bottom and click the Advanced Settings button
Click on the Application behavior protection tab
Scroll down to "Excel macro 4.0 abuse prevention" and uncheck it

 

 

 

 

Let us know if that corrects the issue for you or not.

Thank you

 

 

Edited September 14, 2021 by AdvancedSetup
updated information

[MrJBK]

that's precisely what I did.  It's working now, as I mentioned in my last post ... but I'd really like to understand why adding the .xls files that triggered the exploit detection to the "Allow List" didn't solve the problem by itself.

[AdvancedSetup]

It is not based on a specific XL file. It's the technology behind how they're launched, read, opened, etc.