A Huntress Labs Security Case Study :
Huntress has been hunting malicious actors across 50,000+ user accounts for 1,500+ small businesses enrolled in their Managed Detection and Response (MDR) for Microsoft 365 product.
This is a repost from Huntress Lab’s Security Blog, where they outline three recent cases, and how MDR was able to protect their partner’s accounts. Euclid Networks will begin offering MDR / Microsoft 365 tenant protection in the near future – Contact us today to learn more!
We’ve seen on over a dozen machines today, Microsoft Outlook (Office 365 continual update version) crashes, with 0xc0000005 errors logged in the event log.
The full text of this error is below.
Faulting application name: OUTLOOK.EXE, version: 16.0.13001.20266, time stamp: 0x5ef262ee
Faulting module name: mso98win32client.dll, version: 0.0.0.0, time stamp: 0x5ef2aa2d
Exception code: 0xc0000005
Fault offset: 0x000474b2
Faulting process id: 0x4cf0
Faulting application start time: 0x01d65ac9b0e13874
Faulting application path: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Faulting module path: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso98win32client.dll
Report Id: 908e152f-636f-4f5a-9717-48a5576b3ccd
Faulting package full name:
Faulting package-relative application ID: Microsoft had acknowledged this crash and documented a resulting fix on Twitter, and on the Office 365 Support portal :
Title: Users experiencing Outlook connection issues and crashes
User Impact: Users may experience crashes or may be unable to access Exchange Online via Outlook.
More info: Our analysis indicates that Outlook on the web and mobile clients are unaffected. Users may be able to leverage those protocols as an alternative means to access email and service features while we remediate this problem.
Current status: Our initial review of the available data indicates that recently deployed updates are the likely source of the problem. We're performing an analysis of all recent service updates to isolate the underlying cause of the problem and to determine the most expedient means to restore service.
Scope of impact: This issue may potentially affect any of your users attempting to use Outlook.
The immediate fix for this is to roll back Microsoft Office versions, which can be done by opening a command line as Administrator and typing : cd "\Program Files\Common Files\microsoft shared\ClickToRun"
officec2rclient.exe /update user updatetoversion=16.0.12527.20880
After rolling back versions, Outlook should open and function as normal!
If you’re in need of a proactive, IT Support company in the Atlanta area, don’t hesitate to contact us today!
If you haven’t yet heard, Microsoft is formally ending support for computers running Windows XP, and Office 2003 on April 8th, 2014. Although this date has been announced for some time, we know a considerable number of people who still rely on systems using XP. Read more to find out about what this means to your organization.
Although formal support will end for XP and Office 2003, systems will continue running indefinitely. The main changes to expect with XP’s end-of-life event are :
So, what is a responsible business owner to do? The answer, we think, is not simple. A great number of the world’s computers (an estimated 28%) still rely on XP. Integrated systems also tend to rely on XP, as it is a proven and stable development platform. Practically all U.S. ATMs, for instance, are reported to use the operating system. So, the chance Microsoft will extend support for XP is likely – a notion their Jan 15th announcement supports. And others in the community have expressed their disbelief about the true impact of XP’s ‘death’ as well.
But, all the same – while we won’t preach doom and gloom – it does make sense to begin migrating critical business systems from XP to a newer operating system – and of course, we’re here to help.
Have you ever come across a word or excel document that was ‘password protected’ – where certain parts of the document you were unable to edit?
Frequently these are used in business settings, and with good reason – to protect formulas, proprietary information, sections of contracts, et cetera.
But, sometimes you need to edit a restricted document, and your colleague is not at their computer or out to lunch, on vacation, or otherwise missing in action. Not to worry, we’ll show you how to remove the password from a restricted Word or Excel document. All you’ll need is MS Office 2007/2010/2013, the free software 7-Zip (which we recommend everyone use for archive management!), and a bit of technical support know-how from your local IT pro.
1. Ensure your file is in the latest .docX or .xlsX format. If your file is in an earlier office format, do a ‘Save As’, select ‘docx’ as the format type, and make sure you leave the ‘maintain compatibilty’ box empty. We want the latest file format.
2. Open windows explorer and find your file. Make a copy of the file, and change the file extension from .docx to .zip.
3. Right click the .zip file, and using the 7zip context menu, ‘Open Archive’ using the 7zip archive manager. This will allow you to edit the .docx archive without extracting the XML files inside.
4. Navigate to /word, and find the settings.xml file. Right click the file, and select ‘edit’. – This is important, do not choose ‘open’ or any other option – only ‘edit’ will work.
5. Find the XML element beginning with w:documentprotection, highlighted in the screenshot above. Remove the entire element, including < and > brackets.
6. Save, close, and update the archive when prompted.
7. Rename your file, changing the .zip extension back to .docx
8. Enjoy!
Hopefully this has assisted someone out there in Atlanta, and let us know if this solved your IT support needs in the comments!
Thanks to this post on Spiceworks, and this helpful blog : http://itintheory.blogspot.com/2012/06/remove-editing-restrictions-in-word.html for the inspiration.
