Excel VBA 4.0 Exploit...but no!

[Cronos42]

I have an Excel spreadsheet that I added VBA routines to. Since about two weeks I have not been able to open it anymore because MalwareBytes warns me of a VBA 4.0 exploit. I have managed to open it (restoring it from quarantaine and disabling MalwareBytes) and checked all VBA procedures, and all VBA stuff is mine. So I added the file to the Allow list. Still the same thing happened. So I added the entire folder that it's in to the Allow list. Still the same thing happened. So I added the accompanying Previously Detected Exploit. Still the same thing happened. I am pretty sure that is not how it's supposed to work. Or am I missing something?

[1PW]

Hello @Cronos42 and :

While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility, or its subsets, please carefully follow these instructions:

1. Download the Malwarebytes Support Tool.
2. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file.
3. In the User Account Control (UAC) pop-up window, click Yes to continue the installation.
4. Run the MBST Support Tool.
5. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
6. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer.
7. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. Please do NOT copy and paste.

For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have sent.

Thank you.

[Cronos42]

Here's the file. The "Run FRST" phase took its time. Geez...13 Mb of compressed logs...

 

mbst-grab-results.zip

[Porthos]

You need to go into settings and restore defaults. See if that corrects your issue.

 

•  

[Cronos42]

Unfortunately that leads to the same outcome. The file got quarantained again.

[Porthos]

Just now, Cronos42 said:

Unfortunately that leads to the same outcome. The file got quarantained again.

Please get the log from the detection

You can find Scan and Protection logs within the Malwarebytes 4 program in the following location

 

 

RTP stands for Real-Time Protection and is where automatic protection operations would normally be logged

 

 

If you click on the View option you should get something similar to the following with other options available.

 

 

 

 

Thank you

[Cronos42]

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 02/05/2023
Protection Event Time: 13:02
Log File: dc390f34-e8d8-11ed-9d66-80fa5b4f1ddb.json

-Software Information-
Version: 4.5.26.259
Components Version: 1.0.1976
Update Package Version: 1.0.68880
Licence: Premium

-System Information-
OS: Windows 10 (Build 19045.2728)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Exploit.ExcelMacro4_0Abuse, D:\My Documents\Excel\Data Chronologie.xls, Blocked, 0, 392684, 0.0.0, ,

-Exploit Data-
Affected Application: Microsoft Office Excel
Protection Layer: Application Behavior Protection
Protection Technique: Exploit Excel macro 4.0 abuse blocked
File Name: D:\My Documents\Excel\Data Chronologie.xls
URL:

 

(end)

[Cronos42]

I have in the mean time disabled "Excel Macro 4.0 Abuse Prevention" in "Security" > "Advanced" > "Application behavoir detection" and the file now loads properly. I am now, however, less well protected...

[leo3487]

On 5/2/2023 at 11:56 AM, Cronos42 said:

I have in the mean time disabled "Excel Macro 4.0 Abuse Prevention" in "Security" > "Advanced" > "Application behavoir detection" and the file now loads properly. I am now, however, less well protected...

No neceesarily, if you open Office documents with macros, self-made or from co-workers