windows 10 language hotkey message box detected as microsoft office exploit

[Ut1234]

i was getting a different language keyboard pack installed and when i pressed alt shift windows gave me a box that let me open the windows 10 language hotkey window. malwarebytes detected it as an exploit.

false positive windows hotkey.txt

[Porthos]

@Ut1234

Lets use the support tool and do a clean uninstall and reinstall. Restart the computer after the reinstall. Do not change any default settings. Try you process again.

 

Download the Malwarebytes Support Tool.

 

 

Please close all browsers and programs before running the tool. Right click and quit MB from the system tray also.

Once done it will attempt to reinstall both Malwarebytes and Privacy VPN.

Please say no and close the X button on the top right for Privacy if you are not subscribed to it..

[Ut1234]

is it necessary to reinstall MB for a false positive like this or is this indicative of something more serious?

[Porthos]

Just now, Ut1234 said:

is it necessary to reinstall MB for a false positive like this or is this indicative of something more serious?

Have you changed ANY of the advanced settings in the exploit section of Malwarebytes?

[Ut1234]

as far as i am aware, i have not changed any settings in malwarebytes at all aside from switching to dark mode.

[Porthos]

1 minute ago, Ut1234 said:

as far as i am aware, i have not changed any settings in malwarebytes at all aside from switching to dark mode.

Ok then you will have to change one setting. Malwarebytes is getting more aggressive on Anti Exploit protection.

Uncheck the following box under MS Office.

[Ut1234]

I think i'll keep that setting on just so i'm safer overall, but it's nice to have this information on how to turn this off should malwarebytes make it hard to use the pc going forward. thank you for the information, but i do wish for the devs to be aware of this probably niche false positive.

[Porthos]

You can probably enable the keyboard change differently with out using alt shift. Some keyboard shortcuts can trigger exploit protection.

I assume the control is in the control panel. If so just create a shortcut to it.

[overclockable]

Hi, I had the same issue a few minutes ago also whilst trying to install another keyboard input language. I pressed ALT-SHIFT to see whether it works properly and had a Windows pop-up giving me the option to change how I'd like the input change to behave, so I clicked and immediately had an RTP exploit notification from MB.

Event details: Malware.Exploit.Agent.Generic

Application: Windows Control Panel

Layer: Application Behavior Protection

Location: Long text ending with {HOTKEYS} in the end. Shall I provide the full path?

Hope that it is indeed a false "niche" positive as Ut1234 said above.

Thanks!

[Porthos]

1 hour ago, overclockable said:

Hope that it is indeed a false "niche" positive as Ut1234 said above.

You will have to uncheck the same item from

 

[overclockable]

Thanks, Porthos. I've checked a few other topics, and it seems indeed that there are recently more false positives flying around related to "typical" Windows interaction - Office, shortcuts etc.

[Porthos]

1 hour ago, overclockable said:

Thanks, Porthos. I've checked a few other topics, and it seems indeed that there are recently more false positives flying around related to "typical" Windows interaction - Office, shortcuts etc.

Each solution is different. Please post the actual log of the detection.