jkpieterse Posted February 20, 2023 ID:1555472 Share Posted February 20, 2023 It seems the automatic update mechanism of my Microsoft Excel RefTreeAnalyser VBA add-in triggers an exploit (see screenshot). The tool in question can be downloaded directly from here: https://jkp-ads.com/downloadscript.asp?filename=RefTreeAnalyserXL.zip Link to post Share on other sites More sharing options...
Porthos Posted February 20, 2023 ID:1555495 Share Posted February 20, 2023 It seems you or your users have enabled some non-default settings in the exploit section of the advanced settings. I suggest you or them restore the defaults in that section. Link to post Share on other sites More sharing options...
Porthos Posted February 20, 2023 ID:1555496 Share Posted February 20, 2023 It would also help to have the actual log instead of a screenshot. You can find Scan and Protection logs within the Malwarebytes 4 program in the following location RTP stands for Real-Time Protection and is where automatic protection operations would normally be logged If you click on the View option you should get something similar to the following with other options available. Thank you Link to post Share on other sites More sharing options...
jkpieterse Posted February 20, 2023 Author ID:1555506 Share Posted February 20, 2023 Hi @Porthos Thanks for responding. I'll inform the user accordingly. Will revert if I hear anything back from him. Link to post Share on other sites More sharing options...
jkpieterse Posted February 20, 2023 Author ID:1555509 Share Posted February 20, 2023 My customer got back to me: " As I thought, the "Application Hardening" options were left as-is, i.e. I have not changed the defaults. Here is a screenshot from before I clicked "Restore Defaults", followed by the same options screen after clicking "Restore Defaults" and "Apply" <SEE ATTACHED SCREENSHOT> No change, no difference. And here is a log of the actual block event: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 2/8/23 Protection Event Time: 8:15 PM Log File: 18c770e6-a791-11ed-bd2b-d8bbc14ee46c.json -Software Information- Version: 4.5.21.231 Components Version: 1.0.1890 Update Package Version: 1.0.65440 License: Premium -System Information- OS: Windows 11 (Build 22621.1194) CPU: x64 File System: NTFS User: System -Exploit Details- File: 0 (No malicious items detected) Exploit: 1 Exploit.HeapMemoryCodeExecution, , Blocked, 0, 392684, 0.0.0, , -Exploit Data- Affected Application: Microsoft Office Excel Protection Layer: Malicious Memory Protection Protection Technique: Exploit code executing from Heap memory blocked File Name: URL: https://jkp-ads.com/downloa/downloadscript.asp?filename=RefTreeAnalyserXL.xlam " Link to post Share on other sites More sharing options...
Porthos Posted February 20, 2023 ID:1555521 Share Posted February 20, 2023 Make sure the user does not have penetration-testing enabled. Link to post Share on other sites More sharing options...
jkpieterse Posted February 20, 2023 Author ID:1555525 Share Posted February 20, 2023 It was disabled, as per your screen-shot. Link to post Share on other sites More sharing options...
Porthos Posted February 20, 2023 ID:1555526 Share Posted February 20, 2023 I will ask @Arthi to look into your issue. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now