Unsure if VBScript.dll is corrupted. Malwarebytes blocks VB Script

[JamesBenjamin]

I am trying to run some inbuilt Excel functions but am prevented by Malwarebytes (MWB) with message below this paragraph. I have tried excluding VBScrpit.dll from MWB but I still get the same message. I am not sure if there is malicious code in the library or not. Any help much appreciated!

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 10/03/2023
Protection Event Time: 11:29
Log File: a4aba6ee-beda-11ed-a537-482ae381d0cf.json

-Software Information-
Version: 4.5.23.241
Components Version: 1.0.1927
Update Package Version: 1.0.66507
Licence: Premium

-System Information-
OS: Windows 11 (Build 22621.1265)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Exploit.VBScriptExecution, C:\Windows\System32\vbscript.dll, Blocked, 0, 392684, 0.0.0, E4A087577558551B805BA9278AC66790, D129F9FB6D4CC4A2F8586776EE29028D06EE3C4AF889A5EFA7CA8DE6F6F2C995

-Exploit Data-
Affected Application: Microsoft Office Excel
Protection Layer: Application Hardening
Protection Technique: Attempt to execute VBScript blocked
File Name: C:\Windows\System32\vbscript.dll
URL: 

(end)

[Porthos]

Uncheck the following in the advanced exploit settings.

[JamesBenjamin]

Thanks very much Porthus  for the response and apologies for the delay responding it seems to have stopped one of the problems.

Now there's a corrupted "Quandl.Excel.UDF.Functions64.xll" to deal with! Any ideas?

(Message: "Sorry, we couldn't find //path to the above file name//.)

Also what about malicious VB script in macros. Will MWB Pro still pick them up?

Many thanks again and apologies for the delay in responding!

[Porthos]

1 minute ago, JamesBenjamin said:

Now there's a corrupted "Quandl.Excel.UDF.Functions64.xll" to deal with! Any ideas?

You might have to do a repair on Office. https://support.microsoft.com/en-us/office/repair-an-office-application-7821d4b6-7c1d-4205-aa0e-a6b40c5bb88b

6 minutes ago, JamesBenjamin said:

Also what about malicious VB script in macros. Will MWB Pro still pick them up?

Unfortunately, you can't have it both ways. The best defense is to be sure any attachments from email are expected and trusted before opening.

[JamesBenjamin]

Just now, JamesBenjamin said:

Thanks very much Porthus  for the response and apologies for the delay responding it seems to have stopped one of the problems.

Now there's a corrupted "Quandl.Excel.UDF.Functions64.xll" to deal with! Any ideas?

(Message: "Sorry, we couldn't find //path to the above file name//.)

Also what about malicious VB script in macros. Will MWB Pro still pick them up?

Many thanks again and apologies for the delay in responding!

Sorry Porthos!

[JamOrange]

On 3/10/2023 at 3:52 AM, Porthos said:

Uncheck the following in the advanced exploit settings.

Hello @Porthos - I'm having the same issue, but the above solution does not resolve it?

-System Information-
OS: Windows 10 (Build 19045.2846)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Exploit.VBScriptExecution, C:\Windows\SysWOW64\vbscript.dll, Blocked, 0, 392684, 0.0.0, D726550142BF1D098D0E9F65EE58A05F, 59A2413759882179E235F1BFF6185148F73305EEF3D2661C8EE318017692A714

-Exploit Data-
Affected Application: Microsoft Office Excel
Protection Layer: Application Hardening
Protection Technique: Attempt to execute VBScript blocked
File Name: C:\Windows\SysWOW64\vbscript.dll
URL: 

Thanks

JamOrange

[Porthos]

15 minutes ago, JamOrange said:

but the above solution does not resolve it?

Did you click Apply after unchecking the box?

[JamOrange]

Yes, I did, but apologies, I'm now getting a different error - my script is intentionally scanning my email inbox for email that match my search requirements and process them accordingly into Excel.

Exploit: 1
Exploit.OfficeVBE7objectAbuse, D:\Documents\Outlook.Application, Blocked, 0, 392684, 0.0.0, , 

-Exploit Data-
Affected Application: Microsoft Office Excel
Protection Layer: Application Behavior Protection
Protection Technique: Exploit Office VBE7 object abuse blocked
File Name: D:\Documents\Outlook.Application
URL: 

Many thanks

JamOrange

 

 

 

[Porthos]

10 minutes ago, JamOrange said:

Protection Technique: Exploit Office VBE7 object abuse blocked

[JamOrange]

Many thanks for this, it got me a step closer - but another error, so I had to also disable "Office WMI Abuse Prevention" to get the script to run successfully.

But this is the only script I'm having issues with, as it does more - but not worth disabling 3 elements of protection to get it to work:

• Disable loading of VBScript libraries
• Office VBE7 abuse prevention
• Office WMI Abuse Prevention

I think the only and safest option is to turn them all 3 back on and only turn off Malwarebytes when I want to run the script and then restart Malwarebytes?

Regards

JamOrange

[Porthos]

1 hour ago, JamOrange said:

I think the only and safest option is to turn them all 3 back on and only turn off Malwarebytes when I want to run the script and then restart Malwarebytes?

Correct