BigRedConsulting Posted September 19, 2023 ID:1589994 Share Posted September 19, 2023 Malwarebytes recently started blocking the IIF Transaction Creator and other tools we offer that use the same code base. We're not sure what it object to, as our clients haven't been able to communicate that to us. IIF Transaction Creator.zip Link to post Share on other sites More sharing options...
Staff shadowwar Posted September 19, 2023 Staff ID:1590033 Share Posted September 19, 2023 Moving this to anti exploit as this is an excel file it seems. Do you have a log showing the detections? Link to post Share on other sites More sharing options...
BigRedConsulting Posted September 19, 2023 Author ID:1590034 Share Posted September 19, 2023 No, I don't have a log file. I will ask a customer for one. Do you have steps to create/share a log file? Link to post Share on other sites More sharing options...
Staff shadowwar Posted September 19, 2023 Staff ID:1590035 Share Posted September 19, 2023 follow the instructions for 4.x most likely Link to post Share on other sites More sharing options...
Staff shadowwar Posted September 19, 2023 Staff ID:1590036 Share Posted September 19, 2023 Also as a workaround till we fix this they can add it to the ignore list. Link to post Share on other sites More sharing options...
BigRedConsulting Posted September 19, 2023 Author ID:1590040 Share Posted September 19, 2023 Customer previously reported that they tried to add it to the ignore list but it didn't stick: "I followed directions to re-enable it then restarted Excel and my malware protection software, Malwarebytes, prevented Excel from loading. I opened Malwarebytes and told it to allow the .xla file. I then ran Excel again and Malwarebytes again blocked Excel from starting." IMO this is somewhat rude behavior on the part of Malwarebytes, to actually cause Excel to choke when trying to load an add-in that you don't happen to like..., that the user has indicated they want to load... In any case, maybe the customer doesn't know how to add it to the ignore list properly. Do you have steps? Best, Steuart Link to post Share on other sites More sharing options...
Staff shadowwar Posted September 19, 2023 Staff ID:1590048 Share Posted September 19, 2023 They can disable the exploit protection module till the exploit team replies. I am not the familiar with exploit module but it probably is blocking your vbscripts in the excel file so may be related to on of those shields. Link to post Share on other sites More sharing options...
Staff shadowwar Posted September 19, 2023 Staff ID:1590050 Share Posted September 19, 2023 If you can get the log showing the block there may be a better workaround then shutting down the whole module for now. Link to post Share on other sites More sharing options...
BigRedConsulting Posted September 19, 2023 Author ID:1590079 Share Posted September 19, 2023 The client writes: "I have tried it multiple times and found that no matter whether I stand on both feet, only the left, or only the right, nothing works. I am sending two text files because Malwarebytes creates two files every time I try to run Excel with the BRC add-in. I also did a screenshot to show that it has happened multiple times. "I had read Malwarebytes help files for problems such as mine and it is supposed to let you open a detected problem in the history and create an exception for it, but Malwarebytes will not allow me to open history items from the page where I am supposed to be able to accomplish that task." ------------------------------------------------ One of the log files appears to be you stopping the add-in from downloading a configuration text file from our site. Why would you do that? Downloading files is a rather standard thing computer do... The other identifies a "Exploit.HeapMemoryCodeExecution". I don't know what that means, but I'm thinking it's either a false positive or something is happening indirectly through the Excel app that the add-in has no control over. 9-19-23 at 1001 Exploit.txt 9-19-23 at 1001 Exploit He...eExecution.txt Link to post Share on other sites More sharing options...
Staff shadowwar Posted September 20, 2023 Staff ID:1590096 Share Posted September 20, 2023 If they disable this shield it should allow it for now. Protection Layer: Malicious Memory Protection Protection Technique: Exploit code executing from Heap memory blocked Link to post Share on other sites More sharing options...
Porthos Posted September 20, 2023 ID:1590098 Share Posted September 20, 2023 Also, make sure the following is not enabled. Link to post Share on other sites More sharing options...
BigRedConsulting Posted September 20, 2023 Author ID:1590101 Share Posted September 20, 2023 Customer is up and running after disabling the what I think you call exploit. I wish I could fathom what some of these things mean. It's all Greek to me. But then I'm just a coder. Link to post Share on other sites More sharing options...
Staff Arthi Posted September 20, 2023 Staff ID:1590104 Share Posted September 20, 2023 Hi, Thanks for your post. Can you please go to Settings->security->Exploit protection Advanced settings and uncheck the setting marked in red and hit Apply. This should take care of all the Heap Memory blocks you are seeing in your machine. Thanks. Link to post Share on other sites More sharing options...
BigRedConsulting Posted September 20, 2023 Author ID:1590118 Share Posted September 20, 2023 What is "Malicious return address detection"? Sounds like something to do with email. Link to post Share on other sites More sharing options...
Porthos Posted September 20, 2023 ID:1590119 Share Posted September 20, 2023 16 minutes ago, BigRedConsulting said: What is "Malicious return address detection"? Sounds like something to do with email. Please do what she recommended. She is the staff member who knows the anti-exploit portion of Malwarebytes the best. Link to post Share on other sites More sharing options...
Staff shadowwar Posted September 20, 2023 Staff ID:1590163 Share Posted September 20, 2023 it has to do with memory addresses Link to post Share on other sites More sharing options...
BigRedConsulting Posted September 21, 2023 Author ID:1590533 Share Posted September 21, 2023 OK, well there's no special code in the add-in that works directly with memory addresses. It's VBA code working within Excel's framework. So, not sure what Malwarebytes is seeing. When can I expect an update on this? Our tools aren't doing anything wrong and your app is hampering both our business and our clients' businesses. Link to post Share on other sites More sharing options...
Porthos Posted September 28, 2023 ID:1592063 Share Posted September 28, 2023 The beta that was released today has the anti-exploit fix included. You may get the beta by enabling BETA updates and checking for updates. This is the version with the fix. Link to post Share on other sites More sharing options...
BigRedConsulting Posted September 28, 2023 Author ID:1592094 Share Posted September 28, 2023 Thanks for the update! Link to post Share on other sites More sharing options...
BigRedConsulting Posted December 27, 2023 Author ID:1607642 Share Posted December 27, 2023 We are still seeing issues from our customers that use our tools, and not just the IIF Transaction Creator. Malwarebytes keeps blocking our excel add-ins, which causes Excel to hang - and other bad behavior. What can I do to keep this from happening? For example, I could supply a list of add-in file names. Link to post Share on other sites More sharing options...
BigRedConsulting Posted January 5 Author ID:1609355 Share Posted January 5 Is anyone here to answer user concerns? Link to post Share on other sites More sharing options...
Porthos Posted January 5 ID:1609356 Share Posted January 5 (edited) On 12/27/2023 at 1:06 PM, BigRedConsulting said: What can I do to keep this from happening? For example, I could supply a list of add-in file names. The only thing you can do is tell your users to follow the instructions given in this post. @Arthi Edited January 5 by Porthos Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now