Excel 2021 | File Is in use | Locked for editing | Am i infected

[JhonHamilton]

Today i faced an error in my excel file.    
Here is the error :    
https://i.stack.imgur.com/I7Wut.png
https://i.stack.imgur.com/keTJT.png
That user name is me.   
I checked task manager for all open excel instances for close.   
Nothing found.   
I rebooted my pc. Problem is still there.    
When i copy that file in new location it is working.   
When i open file in notify mode and try to change and save it i faced this error :   
https://i.stack.imgur.com/EshyD.png

In properties of that file read only option have not checked.

I did check and uncheck it, Not help.

What is going on and what is this error?   
Am i infected with a virus like ransomware?

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[lmacri]

Hi JhonHamilton:

From my 11-Jun-2022 post in Adam2022's Excel Macro 4.0 Abuse Protection Prevents Opening Password Protected Files:

Quote

It's probably not a coincidence that one of my other Excel .XLSX files that is not password protected would only open in read-only mode this morning.  I solved that particular problem by opening in read-only mode and then saving under a new file name.  If this happens again I'll try to remember to grab a screenshot of the warning message.

Are you able to open your Excel file if you DISABLE the Excel Macro 4.0 Abuse Prevention protection technique in Malwarebytes (Settings | Security | Exploit Protection | Advanced Settings | Application Behavior Protection | MS Office column | Excel Macro 4.0 Abuse Prevention)?

It would be helpful if you could run the Malwarebytes Support Tool (Advanced tab | Gather Logs) and attach the mbst-grab-results.zip file to your next post.  If the .zip file is created on your desktop it will have to be moved to a different location (e.g., to your Documents or Downloads folder) before you can attach it to your post.
-----------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.1 * Microsoft Defender v4.18.2203.5-1.1.19200.6 * Malwarebytes Premium v4.5.9.198-1.0.1699 * Macrium Reflect Free v8.0.6758 * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited June 12, 2022 by lmacri

[JhonHamilton]

It worked by disabling that option.

But i want to keep that option enable.

My MalwareBytes is licensed latest version.(I updated now)

I checked that file for macros.

There is no macros on that file.

What should i do to keep that option enable?

[lmacri]

22 minutes ago, JhonHamilton said:

It worked by disabling that option.  But i want to keep that option enable...

Hi JhonHamilton:

See Malwarebytes employee AdvancedSetup's 11-Jun-2022 post <here> in Adam2022's thread. Malwarebytes has acknowledged that there is a bug in the Excel Macro 4.0 Abuse Prevention protection technique of Malwarebytes' Exploit Protection that seems to have been introduced by Malwarebytes Premium v4.5.9.198-1.0.1699 (rel 10-Jun-2022) and that it could take "days for a fix or weeks or months".  In the mean time AdvancedSetup is advising that MS Excel users leave the Excel Macro 4.0 Abuse Prevention protection technique DISABLED in their advanced Exploit Protection settings until a bug fix is released.

It would still be helpful if you could attach your mbst-grab-results.zip diagnostic logs generated by the Malwarebytes Support Tool (Advanced tab | Gather Logs) to your next reply.  Attached logs can only be viewed by Malwarebytes employees and a few technical experts with advanced permissions, and those logs will show Malwarebytes your current Windows OS, Malwarebytes version and custom settings, etc.  The more information they can gather about affected systems the sooner this bug will be fixed.
-----------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.1 * Microsoft Defender v4.18.2203.5-1.1.19200.6 * Malwarebytes Premium v4.5.9.198-1.0.1699 * Macrium Reflect Free v8.0.6758 * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

[JhonHamilton]

Ok, thanks.

Please reply here when you fix this bug.

[AdvancedSetup]

The standalone version of Malwarebytes Anti-Exploit already has this fixed, but it will still be a while before that update is applied to our main product Malwarebytes

 

[JhonHamilton]

Thanks for the reply.

Please let us know when it is available on update.

[JhonHamilton]

but it will still be a while before that update is applied to our main product Malwarebytes >>>

Is it working now?

[lmacri]

On 6/14/2022 at 9:05 PM, JhonHamilton said:

but it will still be a while before that update is applied to our main product Malwarebytes >>>

Is it working now?

Hi JhonHamilton:

I'd suggest you subscribe to Adam2022's thread Excel macro 4.0 abuse protection prevents opening password protected files.  If you follow that thread you will receive an automatic email notification when a new reply is posted in that thread, and someone will eventually post there when a bug fix is released.

Also note that the latest Malwarebytes v4.5.10.200-1.0.1702 (released 15-Jun-2022, see Erix's change log in Malwarebytes 4.5) does not fix this problem.

-----------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.1 * Microsoft Defender v4.18.2203.5-1.1.19200.6 * Malwarebytes Premium v4.5.10.200-1.0.1702 * Macrium Reflect Free v8.0.6758 * MS Office 2019 Home and Business Version 2205 (Build 15225.20204 Click-to-Run)
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited June 16, 2022 by lmacri

[lmacri]

Hi JhonHamilton:

Just an update to let you know that I tested with the latest Malwarebytes v4.5.10.200-1.0.1709 (see Erix's 30-Jun-2022 change log in Malwarebytes 4.5) and the new Component Package v1.0.1709 does not appear to have fixed the problem.  See my 01-Jul-2022 post in Adam2022's Excel Macro 4.0 Abuse Protection Prevents Opening Password Protected Files for further details.
------------
64-bit Win 10 Pro v21H2 build 19044.1766 * Firefox v102.0.0 * Microsoft Defender v4.18.2205.7-1.1.19300.2 * Malwarebytes Premium v4.5.10.200-1.0.1709 * Macrium Reflect Free v8.0.6758 * Inspiron 5583/5584 BIOS v1.18.0 * MS Office 2019 Home and Business Version 2205 (Build 15225.20288 Click-to-Run)
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited July 1, 2022 by lmacri

[AdvancedSetup]

@lmacri

Please check again for updates. Then restart the computer and test again. If still not working then please get us new logs from MBST

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

 

[lmacri]

39 minutes ago, AdvancedSetup said:

Please check again for updates. Then restart the computer and test again. If still not working then please get us new logs from MBST

Hi AdvancedSetup:

Here are the requested diagnostic logs.

mbst-grab-results.zip

Please read my 01-Jul-2022 post in Adam2022's Excel Macro 4.0 Abuse Protection Prevents Opening Password Protected Files. The Malwarebytes Help Desk sent me Malwarebytes Anti-Exploit (MBAE) BETA v1.13.1.488 on 20-Jun-2022 for testing but my test results were mixed (I could open password-protected Excel 2019 .XLSX workbooks but for some reason my unprotected workbooks would not open correctly) so the software devs have gone back to the drawing board.

I assume the Malwarebytes Help Desk will send me another MBAE BETA for testing once they are relatively certain they have a working solution.
------------
64-bit Win 10 Pro v21H2 build 19044.1766 * Firefox v102.0.0 * Microsoft Defender v4.18.2205.7-1.1.19300.2 * Malwarebytes Premium v4.5.10.200-1.0.1709 * Macrium Reflect Free v8.0.6758 * MS Office 2019 Home and Business Version 2205 (Build 15225.20288 Click-to-Run) * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

[Vortex_800]

AdvancedSetup

Thanks, I updated it and it is working now.

Really really appreciate for the fix.

[lmacri]

14 minutes ago, Vortex_800 said:

... I updated it and it is working now. Really really appreciate for the fix.

Hi Vortex_800:

After you reset your Malwarebytes Exploit Protection settings back to their defaults (Settings | Security | Exploit Protection | Advanced Settings | Application Behavior Protection | Restore Defaults | Apply) did you remember to click Apply?  After changing my Exploit Protection settings back to their defaults I usually close the Malwarebytes interface and then re-open just to confirm that Excel Macro 4.0 Abuse Prevention has been re-ENABLED (checked) before I run my tests.

That's great news, though, if Component Package v1.0.1709 solved your problem.  What version of MS Excel do you use?
------------
64-bit Win 10 Pro v21H2 build 19044.1766 * Firefox v102.0.0 * Microsoft Defender v4.18.2205.7-1.1.19300.2 * Malwarebytes Premium v4.5.10.200-1.0.1709 * Macrium Reflect Free v8.0.6758 * MS Office 2019 Home and Business Version 2205 (Build 15225.20288 Click-to-Run) * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited July 1, 2022 by lmacri

[Vortex_800]

11 minutes ago, lmacri said:

Hi Vortex_800:

After you reset your Malwarebytes Exploit Protection settings back to their defaults (Settings | Security | Exploit Protection | Advanced Settings | Application Behavior Protection | Restore Defaults | Apply) did you remember to click Apply?  After changing my Exploit Protection settings back to their defaults I usually close the Malwarebytes interface and then re-open just to confirm that Excel Macro 4.0 Abuse Prevention has been re-ENABLED (checked) before I run my tests.

That's great news, though, if Component Package v1.0.1709 solved your problem.  What version of MS Excel do you use?
------------
64-bit Win 10 Pro v21H2 build 19044.1766 * Firefox v102.0.0 * Microsoft Defender v4.18.2205.7-1.1.19300.2 * Malwarebytes Premium v4.5.10.200-1.0.1709 * Macrium Reflect Free v8.0.6758 * MS Office 2019 Home and Business Version 2205 (Build 15225.20288 Click-to-Run) * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

You mentioned at the good point.

Problem still exists there.

I double checked my MalwareBytes.

When i check "Excel Macro 4.0 Abuse Prevention" and press apply excel files open in read only mode.

When i close and open MalwareBytes that check box unckecks by itself.

This is why i thought it is working.

[Vortex_800]

I am using microsoft office 2021 in windows 10.

[Porthos]

The current beta should fix this issue.

Announcement: Malwarebytes 4.5 Beta
 

What’s New in this Beta:

• Obfuscation of critical data
• Detection and remediation improvements
• Performance improvements

Some Issues now addressed:

• Fixed: Anti-exploit corrupting excel files
• Fixed: Uninstall survey being displayed when MBAM is uninstalled by MBST
• Fixed: Unnecessary tamper protection errors in logs

[Vortex_800]

I installed v4.5.10.200

Problem still exists there.

When i check "Excel Macro 4.0 Abuse Prevention" and press apply excel files open in read only mode.

When i close and open MalwareBytes that check box unckecks by itself.

 

[Porthos]

8 minutes ago, Vortex_800 said:

I installed v4.5.10.200

Did you install the BETA.

You have to enable the beta setting and check for updates.

If you do not wish to install you can wait for the official release.

Edited July 8, 2022 by Porthos

[Vortex_800]

Now i am in version of 4.5.11.202.

I checked that check box.

Problem solved on this version & i can open excel files without read-only mode.

But there is a new problem.

When i check "Excel Macro 4.0 Abuse Prevention" and press apply excel files open in normal mode.

When i close and open MalwareBytes that check box unckecks by itself.

Why?

 

[Porthos]

9 minutes ago, Vortex_800 said:

When i close and open MalwareBytes that check box unckecks by itself.

Why?

Did you click apply?

It appears it is by design in this version. I reproduced it as well. It could have been the final fix?

@tetonbob

Edited July 8, 2022 by Porthos

[Vortex_800]

Thanks.

I will check this thread repeatedly.

[Arthi]

Hi All,

That setting "Excel Macro 4.0 Abuse Prevention" has been forced "unchecked" by Malwarebytes due to a known issue, it will be back to normal "checked" as soon we roll out the fix in the next few days. Thank you.

Edited July 8, 2022 by AdvancedSetup
Corrected font issue

[lmacri]

Hi JhonHamilton:

You should be able to open password-protected Excel workbooks again with Excel Macro 4.0 Abuse Protection ENABLED after you update to the latest stable release of Malwarebytes v4.5.11.202-1.0.1716 (rel. 13-Jul-2022).  See Dell employee Erix's release notes <here> for v4.5.11.202-1.0.1716, which state in part "Fixed: Anti-Exploit Corrupting Excel Files".  I tested a beta version of Malwarebytes Premium v4.5.11.202-1.0.1716 on 11-Jul-2022 for Malwarebytes Tech Support and confirmed I could open my password-protected Excel .XLSX workbooks correctly after the new Component Package v1.0.1716 was installed.

if you don't want the to wait for your automatic updates to apply the v4.5.11.202-1.0.1716 product update go to Settings | General | Application Updates and click Check for Updates to start the installation.

I checked today and it looks like Malwarebytes is still silently disabling Excel Macro 4.0 Abuse Protection every time I re-boot my computer even though I've had the fix for a few days now, so before you run your own tests with the new Malwarebytes v4.5.11.202-1.0.1716 see the hints I posted today in Adam2022's Excel Macro 4.0 Abuse Protection Prevents Opening Password Protected File.
---------------
Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.1766 * Firefox v102.0.1 * Microsoft Defender v4.18.2205.7-1.1.19300.2 * Malwarebytes Premium v4.5.11.202-1.0.1716 * Macrium Reflect Free v8.0.6867 * MS Office 2019 Home and Business Version 2206 (Build 15330.20230 Click-to-Run)

Edited July 14, 2022 by lmacri