Excel macro 4.0 abuse protection prevents opening password protected files

[Porthos]

14 minutes ago, Adam2022 said:

I initially called on the phone to report this problem and the support person I spoke to refused to help me unless I allowed him to remote into my computer, which I did not, and insisted there was no other way to help me. 

I do not know who you called but it was not Malwarebytes as Malwarebytes does not have a consumer support number. You dodged a remote support scam there.

14 minutes ago, Adam2022 said:

How about a quick Hot Fix that disables that feature in the interim

There not real quick fixes that can be rolled out. It would open up other users to an infection vector if that the setting was just turned off for everyone.

Edited June 12, 2022 by Porthos

[Adam2022]

OK that's embarrassing. I looked at my browsing history and just before I got that call I was at ewebprotection.info.  I must have live chatted with someone on that web site thinking it was Malwarebytes support. You're right I dodged a scam there but I don't allow anyone to remote into my computer no matter what.  I don't know how I was on that site in the first place!  Excuse me while I do a full system scan !!!!! lmfao

 

As for a quick fix there must be some way to warn users about what is happening. To be told your file is corrupted and cannot be recovered or repaired is scary.  There are probably a lot of people out there who have no idea how to make the association between that and Malwarebytes.  Take it from an IT professional who live chatted with a scam web site agent.   

 

 

[Adam2022]

Ironically enough I have scam protection enabled 

[Porthos]

4 minutes ago, Adam2022 said:

Ironically enough I have scam protection enabled 

This is the part that would have blocked the site but it is off by default due to the massive FP's reported.

[Adam2022]

Fair enough, but for someone to be told their documents are corrupted and unrepairable IMO is worse and worth disabling macro protection especially considering microsoft disables macros by default now. You could easily make a popup in Malwarebytes to notify users of this issue and instruct them on how to disable macros within excel anyway.

[lmacri]

Hi AdvancedSetup:

As I noted in my 11-Jun-2022 post <above>, "It's probably not a coincidence that one of my other Excel .XLSX files that is not password protected would only open in read-only mode this morning.  I solved that particular problem by opening in read-only mode and then saving under a new file name..."  After reading JhonHamilton's Excel 2021 | File Is in use | Locked for editing | Am i infected  today I suspect that other users are now finding that Excel Macro 4.0 Abuse Prevention is also causing issues with Excel files that are not password-protected.

I ran further tests today using the default settings for Advanced Exploit Protection in MB v4.5.9-1.0.699 (rel. 09-Jun-2022) and MS Office 2019 (Click-to-Run) and can confirm:

• I am able to open a password-protected MS Word 2019 .DOCX file.
• I am not able to open a password-protected MS Word 2019 .DOCX file. I see an Microsoft Excel error message that says "We found a problem with some content in '<filename>.xlsx'. Do you want us to recover as much as we can? If you trust the source of this workbook, click Yes".  If I choose "Yes" I see a second Microsoft Excel error stating "The workbook cannot be opened or repaired by Microsoft because it is corrupt".
• I am able to open the same password protected MS Word 2019 .DOCX file if I DISABLE the Excel Macro 4.0 Abuse Prevention protection technique in Malwarebytes (Settings | Security | Exploit Protection | Advanced Settings | Application Behavior Protection | MS Office column | Excel Macro 4.0 Abuse Prevention)
• There is nothing in the Malwarebytes detection history (e.g., no Malware.Exploit.Agent.Generic detection logged) to indicate that Malwarebytes Exploit Protection is preventing my "corrupt" password-protected Excel file from being opened.

 

I agree with the OP Adam2022 that fixing this bug should be a priority, since users who see these Microsoft Excel pop-ups will likely assume that they have been infected by malware that has corrupted their .XLSX files and will have no idea that Malwarebytes Exploit Protection is the cause.  I logged in to my Malwarebytes account yesterday and filed a support request just in case the software developers would like me to submit a Process Monitor log to help diagnose the problem.

This is the second Malwarebytes support request I've submitted in the past week (see my 04-Jun-2022 post in juantho's Malware and PUP PROTECTION Does not allow me to eject my USB after Run .exe).  The fact that I initially had no idea that a Malwarebytes v4.5.9 was responsible for either of these issues makes me wonder if there are other problems with MB v4.5.9 that I haven't uncovered yet, and I am seriously considering preventing my Malwarebytes real-time protection from starting at boot-up (Security | Windows Startup | Launch Malwarebytes in the Background When Windows Starts Up | OFF) until both these bugs are fixed.
---------------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.1 * Microsoft Defender v4.18.2203.5-1.1.19200.6 * Malwarebytes Premium v4.5.9.198-1.0.1699 * Macrium Reflect Free v8.0.6758 * MS Office 2019 Home and Business Version 2205 (Build 15225.20204 Click-to-Run) * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited June 12, 2022 by lmacri

[AdvancedSetup]

The standalone version of Malwarebytes Anti-Exploit corrects this issue. However, you cannot run the main release product of Malwarebytes if you run this.

We hope to have it released into the main Malwarebytes product version in the near future

 

[Alfa1956]

7 hours ago, AdvancedSetup said:

The standalone version of Malwarebytes Anti-Exploit corrects this issue. However, you cannot run the main release product of Malwarebytes if you run this.

We hope to have it released into the main Malwarebytes product version in the near future

 

I have a Premium Subscription (several devices) and filed a Support Ticket (3891860) on Saturday (11-JUNE-2022) and no one ever replied. Furthermore, I cannot see my own Support Ticket on the website I placed it on. I got an email from you (support@mail1.malwarebytes.com) but nothing happened ever since.
After getting help from Microsoft I just turned off Malwarebytes on my devices and if things continue as they are I will not spend any more money on Malwarebytes.

[Porthos]

2 minutes ago, Alfa1956 said:

filed a Support Ticket (3891860) on Saturday (11-JUNE-2022) and no one ever replied. Furthermore, I cannot see my own Support Ticket on the website I placed it on. I got an email from you (support@mail1.malwarebytes.com) but nothing happened ever since.

Support tickets are handled in the order received. It generally takes 3-5 weekdays for a response other than the automated ticket number.

[Alfa1956]

3 minutes ago, Porthos said:

Support tickets are handled in the order received. It generally takes 3-5 weekdays for a response other than the automated ticket number.

Hi Porthos,
Thank you again for your information.
3-5 weekdays to give Support for an Antivirus that I payed for (for several devices) seems to me really bad service!

I liked Malwarebytes but if this is their standard, then probably I shall spend my money in another Antivirus.
What bothers me the most is that Malwarebytes knew about this "bug" and didn't even bother to alert users, which caused many of them to spend hours trying to figured out what was happening. At least to alert PAYING users!
Fortunately Microsoft 365 Support is at the moment and they found the solution at the moment.
Again, thank you for your help.

[lmacri]

Hi Adam2022:

I just tested with the latest Malwarebytes v4.5.10.200-1.0.1702 (see Erix's 15-Jun-2022 change log in Malwarebytes 4.5) and Component Package v1.0.1702 does not appear to have fixed the problem.  I reset the advanced settings in my Malwarebytes Exploit Protection back to their defaults (Settings | Security | Exploit Protection | Advanced Settings | Restore Defaults | Apply) and confirmed that Excel Macro 4.0 Abuse Prevention was re-ENABLED, and when I tried to open a password-protected Excel .xlsx file I got the same error.

Looks like we'll have to wait a bit longer for a bug fix.☹️

 

--------------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.1 * Microsoft Defender v4.18.2203.5-1.1.19200.5 * Malwarebytes Premium v4.5.10.200-1.0.1702 * Macrium Reflect Free v8.0.6758 * Dell SupportAssist v3.10.4.18 * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

[Adam2022]

57 minutes ago, lmacri said:

Hi Adam2022:

I just tested with the latest Malwarebytes v4.5.10.200-1.0.1702 (see Erix's 15-Jun-2022 change log in Malwarebytes 4.5) and Component Package v1.0.1702 does not appear to have fixed the problem.  I reset the advanced settings in my Malwarebytes Exploit Protection back to their defaults (Settings | Security | Exploit Protection | Advanced Settings | Restore Defaults | Apply) and confirmed that Excel Macro 4.0 Abuse Prevention was re-ENABLED, and when I tried to open a password-protected Excel .xlsx file I got the same error.

Looks like we'll have to wait a bit longer for a bug fix.☹️

 

--------------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.1 * Microsoft Defender v4.18.2203.5-1.1.19200.5 * Malwarebytes Premium v4.5.10.200-1.0.1702 * Macrium Reflect Free v8.0.6758 * Dell SupportAssist v3.10.4.18 * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

My trial version expired and I've reverted to the free version which does not include any exploit protection. I'm going to have a look at a different program for real time protection.

[Qwakuk]

Can also confirm, 4.5.10 has NOT fixed the excel macro issue

[lmacri]

I tested with the latest Malwarebytes v4.5.10.200-1.0.1709 (see Erix's 30-Jun-2022 change log in Malwarebytes 4.5) and the new Component Package v1.0.1709 does not appear to have fixed the problem.  I reset the advanced settings in my Malwarebytes Exploit Protection back to their defaults (Settings | Security | Exploit Protection | Advanced Settings | Application Behavior Protection | Restore Defaults | Apply) and confirmed that Excel Macro 4.0 Abuse Prevention was re-ENABLED, and when I tried to open a password-protected Excel 2019 .xlsx workbook I got the same "This encrypted file cannot be opened or repaired by Microsoft Excel because it is corrupt" error.

The Malwarebytes Help Desk sent me a Malwarebytes Anti-Exploit (MBAE) BETA v1.13.1.488 for testing on 20-Jun-2022 but it didn't work correctly.  I see that a newer MBAE BETA v1.13.1.494 was posted <here> on 28-Jun-2022 so I'm hoping the software developers are getting closer to a working solution.
------------
64-bit Win 10 Pro v21H2 build 19044.1766 * Firefox v102.0.0 * Microsoft Defender v4.18.2205.7-1.1.19300.2 * Malwarebytes Premium v4.5.10.200-1.0.1709 * Macrium Reflect Free v8.0.6758 * Inspiron 5583/5584 BIOS v1.18.0 * MS Office 2019 Home and Business Version 2205 (Build 15225.20288 Click-to-Run)
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited July 1, 2022 by lmacri

[Alfa1956]

@Imacri,
I tested the same thing and the problem remains exactly the same.
Only with Excel Macro 4.0 turned off I have no problems.
It seems they're trying, but... they sure are not succeeding in solving it.

[smipx013]

Hi All,

 

Does this issue also affect Word DOCX files (Word/Office 2019) that are password protected by any chance?

If not I have a problem with a file I open that is password protected and then try to save.  Most of the time it just hangs on saving. It's only been happening for a week or so and it does sound very similar. The file has been in use for many years with no issues.  I have recetly copied the contents into a new Word document and the new one is also behaving the same.  I have slightly complicated setup with Norton 360 (mutual exclusions) and this has been running very smoothly for a good 6 months. I also have Google drive in the mix with its file uploading / locking / management.  Trying to pin down the root cause is proving quite tricky.  I have used process monitor and nothing is evident in there.  

I now have to go through a process of elimination and its a right pain.

 

Aaargh........

[lmacri]

3 hours ago, smipx013 said:

Does this issue also affect Word DOCX files (Word/Office 2019) that are password protected by any chance?...

Hi smipx013:

I re-tested today with the latest Malwarebytes v4.5.10.200-1.0.1709 and ENABLING Excel Macro 4.0 Abuse Prevention (Settings | Security | Exploit Protection | Advanced Settings | Application Behavior Protection | Restore Defaults | Apply) does not prevent me from opening password-protected MS Word 2019 .DOCX or .DOC documents.  It only prevents me from opening password-protected MS 2019 Excel workbooks.  Note that I used MS Office 2019 Home and Business Version 2206 (Build 15330.20196 Click-to-Run, released 29-Jun-2022) for this test.

If you suspect that Exploit Protection in Malwarebytes Premium is the cause of your problem, turn off your entire Exploit Protection module from the main dashboard and re-boot your system.  If you still can't open a password-protected MS Word document then Malwarebytes' Exploit Protection isn't the cause.

------------
64-bit Win 10 Pro v21H2 build 19044.1766 * Firefox v102.0.0 * Microsoft Defender v4.18.2205.7-1.1.19300.2 * Malwarebytes Premium v4.5.10.200-1.0.1709 * Macrium Reflect Free v8.0.6758 * Inspiron 5583/5584 BIOS v1.18.0 * MS Office 2019 Home and Business Version 2206 (Build 15330.20196 Click-to-Run)
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited July 4, 2022 by lmacri

[Qwakuk]

Office 2021 for me, docx files still open BUT not excel. For now the setting is disabled

[Porthos]

The current beta should fix this issue.

Announcement: Malwarebytes 4.5 Beta
 

What’s New in this Beta:

• Obfuscation of critical data
• Detection and remediation improvements
• Performance improvements

Some Issues now addressed:

• Fixed: Anti-exploit corrupting excel files
• Fixed: Uninstall survey being displayed when MBAM is uninstalled by MBST
• Fixed: Unnecessary tamper protection errors in logs

[lmacri]

Hi Adam2022:

You should be able to open password-protected Excel workbooks again with Excel Macro 4.0 Abuse Protection ENABLED after you update to the latest stable release of Malwarebytes v4.5.11.202-1.0.1716 (rel. 13-Jul-2022).

Dell employee Erix's release notes <here> for v4.5.11.202-1.0.1716 state in part "Fixed: Anti-Exploit Corrupting Excel Files".  I tested a beta version of Malwarebytes Premium v4.5.11.202-1.0.1716 on 11-Jul-2022 for Malwarebytes Tech Support and confirmed I could open my password-protected Excel .XLSX workbooks correctly after the new Component Package v1.0.1716 was installed.

Dell employee Arthi's 08-Jul-2022 post in JhonHamilton's Excel 2021 | File Is in Use | Locked for Editing | Am I Infected notes that Malwarebytes has been silently disabling (unchecking) Excel Macro 4.0 Abuse Protection after every boot-up for the past few weeks because that Excel Macro 4.0 Abuse Protection was causing problems for so many people.  I checked today and it looks like Malwarebytes is still silently disabling Excel Macro 4.0 Abuse Protection every time I re-boot my computer even though I've had the fix for a few days now, so if you're testing with the new Malwarebytes v4.5.11.202-1.0.1716 make sure that you manually RE-ENABLE Settings | Security | Exploit Protection | Advanced Settings | Application Behavior Protection | Excel Macro 4.0 Abuse Protection (or click Restore Defaults, and then click Apply) as shown in the image below before running any tests with your password-protected Excel workbooks.

I suspect Malwarebytes will eventually stop silently disabling that Excel Macro 4.0 Abuse Protection setting at boot-up in a few days once they're confident their bug fix actually solved the problem and doesn't have any negative side effects.

---------------
Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.1766 * Firefox v102.0.1 * Microsoft Defender v4.18.2205.7-1.1.19300.2 * Malwarebytes Premium v4.5.11.202-1.0.1716 * Macrium Reflect Free v8.0.6867 * MS Office 2019 Home and Business Version 2206 (Build 15330.20230 Click-to-Run)

Edited July 14, 2022 by lmacri

[lmacri]

On 7/13/2022 at 9:55 PM, lmacri said:

.... You should be able to open password-protected Excel workbooks again with Excel Macro 4.0 Abuse Protection ENABLED after you update to the latest stable release of Malwarebytes v4.5.11.202-1.0.1716 (rel. 13-Jul-2022).... I suspect Malwarebytes will eventually stop silently disabling that Excel Macro 4.0 Abuse Protection setting at boot-up in a few days once they're confident their bug fix actually solved the problem and doesn't have any negative side effects.

Hi Adam2022:

Malwarebytes employee Arthi posted a status update early today (29-Jul-2022) in Excel 2021 | File Is In use | Locked For Editing | Am I Infected that "The update to disable the setting "Excel Macro 4.0 Abuse Prevention" was revoked, you should be able to turn it ON again in a few hours."

I've re-booted a few times today and my latest test results show that:

• My Excel Macro 4.0 Abuse Prevention setting will now remain ENABLED if I restore my advanced Exploit Protection settings to their default settings (Settings | Security | Exploit Protection | Advanced Settings | Application Behavior Protection | Restore Defaults | Apply) and re-boot my computer (see image below), and
• My password-protected Excel .XLSX workbooks are opening normally with the Excel Macro 4.0 Abuse Prevention setting ENABLED.

Everything looks okay from my end so I've asked Malwarebytes Support to close my support ticket.

-----------
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v21H2 build 19044.1826 * Firefox v103.0.0 * Microsoft Defender v4.18.2205.7-1.1.19400.3 * Malwarebytes Premium v4.5.12.204-1.0.1725 * Macrium Reflect Free v8.0.6867 * MS Office 2019 Home and Business Version 2206 (Build 15330.20264 Click-to-Run)

Edited July 29, 2022 by lmacri