Malwarebytes is Crashing MS Office 365

[Deaniegirl]

Why does Malwarebytes think MS Office 365 is an "Exploit"? 

This started a month or so ago, I had my PC cleaned up, but it's starting again, so I turned off "Exploit Protection".

What's wrong?

 

[Porthos]

@Deaniegirl

Please export the log and post it here please.

[Deaniegirl]

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 11/11/21
Protection Event Time: 10:01 AM
Log File: 566da06a-4319-11ec-8c72-3417ebd46398.json

-Software Information-
Version: 4.4.10.144
Components Version: 1.0.1499
Update Package Version: 1.0.47096
License: Premium

-System Information-
OS: Windows 10 (Build 19043.1348)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Malware.Exploit.Agent - Exploit payload process blocked, C:\Program Files\Google\Drive File Stream\52.0.6.0\crashpad_handler.exe C:\Program Files\Google\Drive File Stream\52.0.6.0\crashpad_handler.exe --database=C:\Users\NEAS\AppData\Local\Google\DriveFS\Crashpad --url=https:\clients2.google.com\cr\report --annotation=application=WINWORD.EXE --annotation=prod=DriveFS --annotation=ver=52.0.6.0 --initial-client-data=0x1f14,0x1e44,0x1fb0,0x1f0c,0x1f8c,0x7ff86f81f820,0x7ff86f81f830,0x7ff86f81f840, Blocked, 0, 392684, 0.0.0, , 

-Exploit Data-
Affected Application: Microsoft Office Word
Protection Layer: Application Behavior Protection
Protection Technique: Exploit payload process blocked
File Name: C:\Program Files\Google\Drive File Stream\52.0.6.0\crashpad_handler.exe C:\Program Files\Google\Drive File Stream\52.0.6.0\crashpad_handler.exe --database=C:\Users\NEAS\AppData\Local\Google\DriveFS\Crashpad --url=https:\clients2.google.com\cr\report --annotation=application=WINWORD.EXE --annotation=prod=DriveFS --annotation=ver=52.0.6.0 --initial-client-data=0x1f14,0x1e44,0x1fb0,0x1f0c,0x1f8c,0x7ff86f81f820,0x7ff86f81f830,0x7ff86f81f840
URL: 

(end)

[Porthos]

I have not seen this exact issue with google drive involved.

I am going to ask @Arthi to assist.

[Deaniegirl]

Thank you

[Porthos]

On 11/11/2021 at 3:10 PM, Deaniegirl said:

Thank you

Do you have the following setting on in advanced exploit system settings?

 

•  

 

[Deaniegirl]

Yes. Does that mean it should be disabled? Because in order to see the Advanced settings, I had to enable the Exploit protection, which I previously disabled because of the crashing problem.

 

 

[Porthos]

Just now, Deaniegirl said:

Does that mean it should be disabled?

Yes, It is not on  by default. Someone had to enable it in the first place.

[Deaniegirl]

Ok. It's disabled.

I don't recall even touching any of the options in Malwarebytes. I figured the default settings were designed with higher knowledge than I have, so I kept them. Only recently did I disable the Exploits because I figured out the correlation with Word crashing.

So, disabling that one setting but leaving Exploits enabled will 'cure' the problem?

Is there anything else I ought to set correctly?

Thank you for your quick responses, Parthos, I appreciate community input since it tends to be more realistic to users and also much more prompt in response times!

(I was a tech writer for software companies--HP, Intel, Xerox, Autodesk, loads of startups, etc.--during the 80s-90s, prior to dot com bust. Had an excellent career!)

[Porthos]

1 minute ago, Deaniegirl said:

So, disabling that one setting but leaving Exploits enabled will 'cure' the problem?

You will need to test. It has worked for others, Let us know if it solves your issue.

[Deaniegirl]

Ok, I will respond if it happens again, but here's to great troubleshooting and your immediate help. I really, truly appreciate it!

Have a wonderful day, Porthos (sorry I misspelled), Nadine Sexton, Novato, CA.