Question All of a sudden I get your administrator has blocked this program or this file has macros errors.

[David_652]

Just in the past week or so I have been receiving these errors that won't let me access my own Word documents. I have to click a dozen times or more to close the error dialogue before I can get to my documents. The most frequent error is about macros being blocked. Today one came up my administrator has blocked this file. I am my administrator. I have repaired office, checked the settings in Word, searched for answers and nothing stops it.

What do you think it is?

 

[USAFRet]

1. Is this a work, or personal PC?

2. What AV do you use?

3. What was the last thing that happened before this started?

4. Where did your Win 11 OS install and license come from?

 

[David_652]

It's my home office PC. I use Windows Defender and Malwarebytes. I don't recall anything in particular happening before it started. The install came with the box.

 

[USAFRet]

Can you get a screencap of these errors?

Upload the pic to imgur.com, post the link here.

 

[David_652]

Can you get a screencap of these errors?

Upload the pic to imgur.com, post the link here.

https://imgur.com/a/EGJV8nr

View: https://imgur.com/a/EGJV8nr
The error about macros comes up when I open Word. The administrator error comes up when I open the most recent Word document.

 

[USAFRet]

The Word file you're trying to open...where did it come from?
That may be a source of infection.

 

[David_652]

I created the file. It never left my PC. It's the same with all affected files.

 

[USAFRet]

I created the file. It never left my PC. It's the same with all affected files.

Wow, this is weird.

 

[USAFRet]

Is it only Word files?

 

[David_652]

Wow, this is weird.

Yes, only word files. New blank, and saved, word files were setting off the macros warnings. Now created files set off the admin warning, as of just this evening.

 

[David_652]

Yes, only word files. New blank, and saved, word files were setting off the macros warnings. Now created files set off the admin warning, as of just this evening.

It looks like the culprit is an add-in. Either ProWritingAid or Grammarly. I don't know why those are setting off warnings. They never did before. System scans do not detect issues with these. Could it be because the vendor has poorly coded those, creating something the system flags? I'm going to look for updates to those. But I may need to add exclusions. Would you know where to add those?

 

[USAFRet]

Yes, only word files. New blank, and saved, word files were setting off the macros warnings. Now created files set off the admin warning, as of just this evening.

Possibly your basic Word template is corrupted.

Try this, to let Word create a new default template.:
https://answers.microsoft.com/en-us...template/07416dcc-593b-424d-9523-1c83b7b537c0

 

[USAFRet]

It looks like the culprit is an add-in. Either ProWritingAid or Grammarly. I don't know why those are setting off warnings. They never did before. System scans do not detect issues with these. Could it be because the vendor has poorly coded those, creating something the system flags? I'm going to look for updates to those. But I may need to add exclusions. Would you know where to add those?

I don't use those...no idea.

 

[Ralston18]

@David_652

I have a question about that "Attacks" file you created - does it contain in full or in part any links, examples, code, foreign language words/phrases, acronyms, images, etc. about how attacks are designed and/or executed?

Especially any copied and referenced from online sources.

Noted the reference to macros - did you include any macro examples or otherwise use some macro when writing the document?

Search your Word folders for any macros. E.g. the template link posted by @USADRet.

What about overall formatting: special characters and codes used to create the document?

Overall consider that that some bit of content may be triggering the blocks.

Something in the document that is being erroneously interpreted as a macro....

Make a copy of the file, edit out any potential culprits, and start adding them back one by one.

Determine if: 1) the blocking stops, and 2) what, if anything, causes the blocking to re-occur.

Start with Pages - will Page 1 as its' own document open without triggering a block?

You could edit out full paragraphs to determine if one particular paragraph or another is the culprit.

Then, if so, work through the sentences within a given paragraph.

And also configure the document to show all hidden characters, formating etc..

Remember to check headers and footnotes.

Another link:

https://learn.microsoft.com/en-us/office/troubleshoot/word/autoexec-autoopen-macros-word

Do some macro "testing" per the link on a new document. Does the new document get blocked etc.?

Reverse engineering....

Just some passing thoughts.

 

[David_652]

It was a text only article. The issue turned out to be a couple of add-ins for word that were causing the issue I resolved it

 

[Ralston18]

Just for the record:

What add-ins for word caused the problem and what was done that resolved the problem?

 

[David_652]

Just for the record:

What add-ins for word caused the problem and what was done that resolved the problem?

ProWritingAid. Grammarly. I rolled back any Windows updates to the system state before the issues started. I also used system restore to restore to a date before the problems began. They're still happening sometimes, but not as much. It's also happening to .bat files. I have no solution for that and had to stop using .bat files.

 

[David_652]

ProWritingAid. Grammarly. I rolled back any Windows updates to the system state before the issues started. I also used system restore to restore to a date before the problems began. They're still happening sometimes, but not as much. It's also happening to .bat files. I have no solution for that and had to stop using .bat files.

You should note that Microsoft has updated Windows Security to have most if not all the features of premium tools like Malwarebytes. So, it may be blocking many things. I tried using exclusions for Apps with no luck.

If you find a solution for all the things Windows Security and/or Windows 11 are blocking now, I'd like to hear it. Should I create a new post for it? Are there existing posts that try to address it?

 

[David_652]

You should note that Microsoft has updated Windows Security to have most if not all the features of premium tools like Malwarebytes. So, it may be blocking many things. I tried using exclusions for Apps with no luck.

If you find a solution for all the things Windows Security and/or Windows 11 are blocking now, I'd like to hear it. Should I create a new post for it? Are there existing posts that try to address it?

I just discovered that for MS Word, turning off settings in Hard Configurator seems to resolve the issues completely. Apparently it blocks macros and controls that the add-ins use. Hard Configurator is a popular Windows hardening tool, which I am very pleased with. I have asked its creator for adjusted settings so I don't have to remove it or the add-ins.