Loading Word (office 365) triggers exploit warning - False Positive?

[stevent10993]

Windows 10, latest updates installed. After loading (and after Malwarebytes flags this), full scan with Malwarebytes shows no infections. Similarly, scanning with Webroot Secure Anywhere current version also reports no infection.

Beginning yesterday morning, loading Office 365 Word triggers the following warning:

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 11/15/22
Protection Event Time: 8:23 AM
Log File: a53f94fe-64e8-11ed-bbf8-b42e99fab9e9.json

-Software Information-
Version: 4.5.17.221
Components Version: 1.0.1806
Update Package Version: 1.0.62324
License: Premium

-System Information-
OS: Windows 10 (Build 19045.2251)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Exploit.LoadLibraryAttempt, C:\Users\Steven\AppData\Local\Temp\Costura\AC4F3CDC0C37AC9CCD91F5D734C876C6\64\e_sqlcipher.dll, Blocked, 0, 392684, 0.0.0, ,

-Exploit Data-
Affected Application: Microsoft Office Word
Protection Layer: Application Behavior Protection
Protection Technique: Exploit LoadLibrary attempt blocked
File Name: C:\Users\Steven\AppData\Local\Temp\Costura\AC4F3CDC0C37AC9CCD91F5D734C876C6\64\e_sqlcipher.dll
URL:

(end)

 

Is this a false positive? If not, how do I remedy this?
 

[stevent10993]

I forgot to say that each time I close Word, then reopen it, the infection comes back. I've even manually deleted the temp folders listed in the log file. But reopening Word just makes them come back. Of course, before word finishes opening, Malwarbytes has deleted the .dll file listed in the log. And Word seems to function properly. But the anxiety I feel re: this being an infection keeps troubling me.

[AdvancedSetup]

Do you get this just starting Microsoft Word or by opening a specific document? @stevent10993

 

This file seems to keep being created:  e_sqlcipher.dll

That is normally associated with creating a SQL encryption

 

[stevent10993]

Thanks so much for getting back to me.

OK. So the "C:\Users\Steven\AppData\Local\Temp\Costura\AC4F3CDC0C37AC9CCD91F5D734C876C6\64\e_sqlcipher.dl" line gets created each time I open Word, no file chosen, program opening only.

In the middle of the Word loading process, Malwarebytes pops up with the exploit warning message.

When I go to my temp directory and look in that folder, Malwarebytes has deleted that file, but left the folder structure.

When I then delete what's left (the folders), then open Word, it all gets happens again, including the warning in the middle of Word loading, and the folders recreated in my Temp directory.

What's especially bad here is the effect this has been having on my ability to Zoom or Skype. When I Zoom with Word open (no file open), even though Malwarebytes has deleted that file, my connection keeps freezing and simultaneously, my desktop refreshes.

[AdvancedSetup]

Okay, let's check the computer out further and see if we can find out what's causing this. I have MS Word as does everyone at Malwarebytes and millions of other customers and I'm not having the issue and I've not seen others report it either so far.

 

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply

Thank you

 

[stevent10993]

OK. I've hopefully followed the instructions. BTW, when I downloaded the support file, my antivirus flagged a file as a threat: "FBSTEnglish.exe" . Is this part of the support install?

mbst-grab-results.zip

[AdvancedSetup]

Thank you for the logs @stevent10993

I don't see any signs of an obvious infection. It may possibly be due to a few different things.

I see that you have have Webroot SecureAnywhere installed. Let make sure you setup exclusions between the programs.

Malwarebytes for Windows antivirus exclusions list
https://support.malwarebytes.com/hc/en-us/articles/360038522974-Malwarebytes-for-Windows-antivirus-exclusions-list

 

Then go to Control Panel, Programs, Programs and Features and uninstall the following

Bonjour

 

What exactly is mDNSResponder.exe? (Bonjour)

https://www.groovypost.com/howto/howto/what-is-mdnsresponder-exe-and-why-is-it-running/

MDNSResponder, also known as Bonjour, is Apple’s native zero-configuration networking process for Mac that was ported over to Windows and associated with MDNSNSP.DLL.  On a Mac or iOS device, this program is used for networking nearly everything.  On Windows, this process is only necessary for sharing libraries via iTunes and other Mac applications like the Apple TV that were ported to Windows.  Bonjour allows different computers running iTunes to communicate with each other regardless of network configuration, this is because it enables automatic network discovery.

What Is mDNSResponder.exe / Bonjour and How Can I Uninstall or Remove It?
https://www.howtogeek.com/howto/6456/what-is-mdnsresponder.exe-bonjour-and-how-can-i-uninstall-or-remove-it/

 

Then open Malwarebytes and click on the small gear icon in the top right to go to Settings
Click on the Security tab and scroll to the bottom
Click on the Advanced settings button
Click on the Restore Defaults button

Then restart the computer and try launching MS Word again and let me know if you're still getting the same block alert or not.

 

 

 

[stevent10993]

I uninstalled Office 365 this AM, as I work online (Zoom) as a therapist and see 35 - 40 people a week, some of whom are suicidal. Whatever this problem is, it's causing frequent but intermittent freezing during sessions. I want to see if this helps.

I do need the Office 365 apps, as they are part of my everyday workflow. So after watching for a day or two to see if the problem will reappear, if it doesn't, I'll reinstall Office 365.

In the meantime, I will also take your advice and uninstall Bonjour. I've seen it come up in the error logs a lot and am not sure if it's something I need.

Finally, know I've boasted to a number of people about how good your support is. I worked for years in IT, have a 4 year degree in it, and was at one time the golden boy in PCs for UPS.

Your support is awesome.

BTW, is it possible I've gotten bitten by the Follina fiasco?

 

[AdvancedSetup]

Thank you for the kind words, appreciated.

It doesn't seem to be the same pattern, but always possible I suppose.

https://en.wikipedia.org/wiki/Follina_(security_vulnerability)

Microsoft patched this vulnerability in its June 2022 patches.

Make sure your Windows Updates are up to date. You can click on Start and type in "Check for updates" then scan for and allow Microsoft to install any updates it finds.

 

You can also use the following tool to make sure other software on the computer is up to date.

Patch My PC Home Updater
https://patchmypc.com/home-updater

 

 

[stevent10993]

I'm compulsively up to date and all that. I'm just confused how that file kept getting recreated when it's not part of Bonjour. I'll let you know what happens. But as of this hour, no problems with Zoom so far.

[AdvancedSetup]

My concern is that possibly some configuration file in Office or the MS Word NORMAL Template is corrupted?

It is not normal to launch MS Word and have it create a DLL file in the %TEMP% folder

https://support.microsoft.com/en-us/office/change-the-normal-template-normal-dotm-06de294b-d216-47f6-ab77-ccb5166f98ea

I'd probably delete the Normal.dotm file myself and try launching MS Word again. It should auto create a new one

 

[AdvancedSetup]

https://support.microsoft.com/en-us/topic/you-receive-error-messages-when-you-start-word-8229b6c3-de7a-e7d8-2aa3-bdb1d1f57ad8

 

[AdvancedSetup]

There are many projects like this one, but it speaks about the use of that file.

https://github.com/ericsink/SQLitePCL.raw/issues/297

Are you or anyone else doing any type of programming on the computer or Web design?

 

[stevent10993]

I uninstalled Office 365 using RevoUninstaller (medium scan & delete), then reinstalled it. This stopped the repeated Malwarebytes warnings and the attempts to write this file (e_sqlcipher.dll) to the temp directory. I also uninstalled Zoom, then reinstalled it, as I've had problems with Zoom intermittently freezing since these warnings began. I'm still working on this and suspect some form of infection. But neither Malwarbytes nor Webroot Anywhere scans show any problem.

[AdvancedSetup]

We can run some other scans @stevent10993 but I thought you said removal and reinstall of MS Office corrected the issue.

Please try running the folloiwng

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
• The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

 

It is normal for the Microsoft Safety Scanner to show detections during the scan process. It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

 

 

[stevent10993]

As of today, there are no signs of ongoing infection. Besides the uninstalls/reinstalls, I disabled the bonjour service in all of my computers, and deleted a line in the registry suggested by Microsoft as a hedge against the Follina problem.

I wish I knew the source of all this. But I may have to accept that I will never know.

Thanks again for the excellent support. I've already bragged about it to a number of people.

[AdvancedSetup]

Thank you for the update and kind words @stevent10993

 

Let's go ahead and do some clean-up work and remove the tools and logs we've run.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt.
• Please attach that file to your next reply. (not compulsory)

 

1. Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
   https://www.howtogeek.com/240255/password-managers-compared-lastpass-vs-keepass-vs-dashlane-vs-1password/
2. Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
3. Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download
4. Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
5. Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
6. Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm 
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak 
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

 

Further reading if you like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/

Hopefully, we've been able to assist you with correcting your system issues.

Thank you for using Malwarebytes

 

[stevent10993]

I tried downloading KpRm using the link you provided. But this triggered a virus warning / quarantine in Webroot Secure Anywhere latest version..

[AdvancedSetup]

Yes, and the image above show how to tell Windows Defender to allow it. The program is safe, they don't like that it's not signed and is not too common.

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks