False Positive - MB Blocking Power-User Add-on For Office

[COSMICX]

There's a legitimate add-on for Microsoft called Power-User and Malwarebyte's keep flagging it as a malware/exploit when it tries to do an update. This tool is legitimate and since it is an add-on that customizes/adds functionality to Microsoft Excel, I assume Malwarebytes flags it as an exploit.

Link to the official product/software:

https://www.powerusersoftwares.com/

 

Malwarebytes Log:
www.malwarebytes.com

-Log Details-
Protection Event Date: 3/2/23
Protection Event Time: 1:49 PM
Log File: 44306448-b8f0-11ed-af19-00ff4c357b3f.json

-Software Information-
Version: 4.5.22.236
Components Version: 1.0.1915
Update Package Version: 1.0.66267
License: Premium

-System Information-
OS: Windows 10 (Build 19045.2604)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Exploit.OfficeLoadingPointsAbuse, C:\WINDOWS\SYSTEM32\msiexec.exe \i D:\Downloads\Power-user (1.6.1571.0).msi \QN, Blocked, 0, 392684, 0.0.0, ,

-Exploit Data-
Affected Application: Microsoft Office Excel
Protection Layer: Application Behavior Protection
Protection Technique: Exploit Office loading points abuse blocked
File Name: C:\WINDOWS\SYSTEM32\msiexec.exe \i D:\Downloads\Power-user (1.6.1571.0).msi \QN
URL:

 

(end)

[Porthos]

First, make sure the following is not enabled.

If it is not, you will need to disable the following.

 

[COSMICX]

11 minutes ago, Porthos said:

If it is not, you will need to disable the following.

Doing this does solve the issue but won't disabling this mean even malicious applications will now be able to execute an exploit?

[Porthos]

3 minutes ago, COSMICX said:

Doing this does solve the issue but won't disabling this mean even malicious applications will now be able to execute an exploit?

Yes. That is the risk/cost of using add-ons.

[COSMICX]

1 minute ago, Porthos said:

Yes. That is the risk/cost of using add-ons.

I see. Is it not possible for the MB team to whitelist it, so other users using the same app don't face an issue and users that do use it don't have to disable their protection settings and be vulnerable to actually malicious add-ons?

 

PS: Thank you so much for all your help, though. I really appreciate it.

[Porthos]

Lets see if @Arthi can weigh in on this.

[COSMICX]

Any update on this?

[COSMICX]

21 minutes ago, RJMII said:

Yes, an update WOULD be great. Not an inexpensive subscription either, but quite handy. This add-on has been knocked this way for years. It's too bad.

For sure. I would love to see them whitelist this. Currently, I disable MB every time there's an update to bypass this issue Hoping the MB team can look into this and get in touch with the PowerUser team and find some solution to get this issue resolved.

[David H. Lipman]

Please note this is @COSMICX's thread.

Do not reply if you are not a member of an Advanced Forum Group.

Thank you.