Excel 2021 | File Is in use | Locked for editing | Am i infected

[Arthi]

Hi Imacri,

We will stop disabling the setting once the update rolls out to most fo the customer base. Just a few more days :)

Thanks.

[Vortex_800]

Thanks for the update.

But something is wrong about it.

I did update it as you explained.

When i check it "Excel Macro 4.0 Abuse Prevention" and apply and close and open MalwareBytes it unchecks for unknown reason.

Please consider about it.

Thanks

 

[Porthos]

5 minutes ago, Vortex_800 said:

When i check it "Excel Macro 4.0 Abuse Prevention" and apply and close and open MalwareBytes it unchecks for unknown reason.

The post above yours explains why it is still doing that even with the new version.

[Vortex_800]

Hi dear moderators,

Did you fix auto disabling "Excel Macro 4.0 Abuse Prevention" after restart MalwareBytes?

[AdvancedSetup]

We have not pushed out a program update since the post.

 

[lmacri]

On 7/14/2022 at 1:46 PM, Arthi said:

... We will stop disabling the setting once the update rolls out to most fo the customer base. Just a few more days :)

1 hour ago, AdvancedSetup said:

We have not pushed out a program update since the post.

Hi AdvancedSetup:

Could you please clarify? The bug fix was included in Malwarebytes v4.5.11.202 -1.0.1716 (rel. 13-Jul-2022), but employee Arthi posted <here> on 17-Jul-2022 that Malwarebytes would stop silently disabling Excel Macro 4.0 Abuse Prevention in "just a few more days".

I tested Malwarebytes v4.5.11.202 -1.0.1716 again on 25-Jul-2022 (assuming that the v4.5.11 update would have rolled out to most customers by then) and confirmed that I can open my password-protected Excel workbooks if my advanced Exploit Protection settings are restored to their default settings (Settings | Security | Exploit Protection | Advanced Settings | Application Behavior Protection | Restore Defaults | Apply) and ENABLE Excel Macro 4.0 Abuse Prevention ...

... but that the Excel Macro 4.0 Abuse Prevention setting is still silently DISABLED as soon as I restart my computer.

Is this silent disabling of Excel Macro 4.0 Abuse Prevention a behaviour that's baked into v4.5.11.202 -1.0.1716, or can Malwarebytes silently enable/disable this setting remotely from their back-end servers?   Your post today implies that the behaviour is baked in to v4.5.11.202 -1.0.1716 and that we will have to wait for the upcoming v4.5.12.204-1.0.1725 (currently in BETA) before we stop seeing Excel Macro 4.0 Abuse Prevention being automatically disabled at each system restart.
-----------
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v21H2 build 19044.1826 * Firefox v103.0.0 * Microsoft Defender v4.18.2205.7-1.1.19400.3 * Malwarebytes Premium v4.5.11.202-1.0.1716 * Macrium Reflect Free v8.0.6867 * MS Office 2019 Home and Business Version 2206 (Build 15330.20264 Click-to-Run)

Edited July 27, 2022 by lmacri

[Arthi]

Hi All,

The update to disable the setting "Excel Macro 4.0 Abuse Prevention" was revoked, you should be able to turn it ON again in a few hours.

Thanks for your patience.

[lmacri]

8 hours ago, Arthi said:

...The update to disable the setting "Excel Macro 4.0 Abuse Prevention" was revoked, you should be able to turn it ON again in a few hours....

Hi Arthi:

Thanks for the status update.  I can confirm that my Excel Macro 4.0 Abuse Prevention setting will now remain ENABLED if I restore my advanced Exploit Protection settings to their default settings (Settings | Security | Exploit Protection | Advanced Settings | Application Behavior Protection | Restore Defaults | Apply) and re-boot my computer.  Note that it took two re-boots of my system today before I could get this setting to stay checked.

I can also confirm that my password-protected Excel files are opening normally with the Excel Macro 4.0 Abuse Prevention setting ENABLED.

I don't know if it's relevant, but I updated to Malwarebytes v4.5.12.204-1.0.1725 yesterday.  When I tested last night my Excel Macro 4.0 Abuse Prevention setting was still silently disabled after a re-boot so I don't think the product update itself actually solved the problem - I'm guessing Malwarebytes had to change something remotely this morning on their own end to revoke the disabling of this setting.
-----------
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v21H2 build 19044.1826 * Firefox v103.0.0 * Microsoft Defender v4.18.2205.7-1.1.19400.3 * Malwarebytes Premium v4.5.12.204-1.0.1725 * Macrium Reflect Free v8.0.6867 * MS Office 2019 Home and Business Version 2206 (Build 15330.20264 Click-to-Run)

Edited July 29, 2022 by lmacri