How to solve the cryptic error "...file format or file extension is not valid..." caused by Window Defender if "Block Win32 API calls from Office macros" rule is set.

Question

  • I have used ASAP Utilities for many years without problems but now Excel suddenly shows the following cryptic error message and I cannot use it:
    "Excel cannot open the file 'ASAP...xlam' because the file format or file extension is not valid. Verify that the file has not been corrupted and that the file extension matches the format of the file."
  • Does ASAP Utilities use Windows API calls?

What causes this error in Excel?

Is your organization currently using (the professional edition of) Windows Defender?

This peculiar error may unfortunately be a result of a specific setting, known as an ASR rule, in either Microsoft Defender for Endpoint or Microsoft 365 Defender. It can block standard Windows functionality and cause interference when Excel tries to open the ASAP Utilities file.

Please understand that this isn't a fault within our software, our files are accurate. Regrettably, there's nothing we can do on our end to resolve this problem.
Ideally, we'd like Excel to inform you directly if the file is being blocked by other Microsoft software. However, it instead displays the rather vague error message "file format or file extension is not valid". We hope that Microsoft will make this error message more insightful in the future.

This article shows more information and how you (or your IT department) can solve it.

Microsoft Defender can block standard Windows functionality

Microsoft Defender for Endpoint and Microsoft 365 Defender can use attack surface reduction rules (ASR rules) to help prevent malware infection.
One of the non-standard protection rules is:

"Block Win32 API calls from Office macros"

In case your company has the rule "Block Win32 API calls from Office macros" defined, then ASAP Utilities can't function properly because it uses Windows API calls.

The Windows API was formerly called Win32 API by Microsoft. The name Windows API more accurately reflects its roots in 16-bit Windows and its support on 64-bit Windows, but the ASR setting still uses the old name. The ASR rule still uses the old name (Win32 API).

When this rule is applied, some users just don't see ASAP Utilities in the Excel menu anymore, others get a cryptic error from Excel stating that the ASAP Utilities file format or file extention is not correct due to this rule. (Excel cannot open the file 'ASAP Utilities.xlam' because the file format or file extension is not valid. Verify that the file has not been corrupted and that the file extension matches the format of the file.)

From Microsoft:

Office VBA enables Win32 API calls. Malware can abuse this capability, such as calling Win32 APIs to launch malicious shellcode without writing anything directly to disk. Most organizations don't rely on the ability to call Win32 APIs in their day-to-day functioning, even if they use macros in other ways.

Intune name: Win32 imports from Office macro code
Configuration Manager name: Block Win32 API calls from Office macros
GUID: 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B

Source:
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-win32-api-calls-from-office-macros

Defender: Warn mode for users

Prior to warn mode capabilities, attack surface reduction rules that are enabled could be set to either audit mode or block mode. With the new warn mode, whenever content is blocked by an attack surface reduction rule, users see a dialog box that indicates the content is blocked. The dialog box also offers the user an option to unblock the content. The user can then retry their action, and the operation completes. When a user unblocks content, the content remains unblocked for 24 hours, and then blocking resumes.

Warn mode helps your organization have attack surface reduction rules in place without preventing users from accessing the content they need to perform their tasks.

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-worldwide#warn-mode-for-users

Does ASAP Utilities use the Windows API?

Yes, ASAP Utilities uses Windows API calls.
This is a common practice. For example, the Solver Add-in and the Euro Currency Tools Add-in from Microsoft that are available when you install Microsoft Office or Excel also use Windows API calls.

Just Excel/VBA itself can be too limited for certain basic actions and ASAP Utilities wouldn't be able to do, or do as smooth, what it can without the few Windows API calls.

The Windows API, provided by Microsoft, offers a robust set of functions and services that allow developers to interact with the Windows operating system effectively. It is widely used by software developers worldwide, including reputable organizations, to build reliable and secure applications.

ASAP Utilities uses a few Windows API calls to provide functionality otherwise not possible in Excel, such as:

Solution: If Windows API calls are blocked, make an exception for ASAP Utilities

In case your organization has the "Block Win32 API calls from Office macros" rules applied in combination with "block mode", then you can still use ASAP Utilities by making and exception for our files as explained by Microsoft.

It goes without saying that there is no malware in our product. We developed ASAP Utilities ourselves and nothing is or was outsourced. Our development team follows industry best practices to ensure that our software is resistant to potential vulnerabilities and exploits.

Please be aware that ASAP Utilities is an Excel add-in that is installed locally on your computer. It operates solely within your local environment and does not involve any remote interaction or access to your data.

ASAP Utilities functions offline within Excel, and any communication with our server is solely for the purpose of license validation and activation. Rest assured that your data remains securely processed on your local machine without any remote involvement.

All the files from ASAP Utilities are signed with a Code Signing certificate to make sure the files (exe and xlam) are from our company and have not been tampered with.
Our company name is A Must in Every Office BV, you can see that in the certificate.
As an extra protection layer In Excel you can choose to disable all macros except digitally signed macros or require application add-ins to be signed by a trusted publisher.

The ASAP Utilities xlam files that use Windows API calls from Microsoft

The "%ProgramFiles(x86)%\ASAP Utilities\" folder is the default installation folder.
In case you installed ASAP Utilities in another location, then the ASAP Utilities.xlam is in that location.

  • All languages:
    %ProgramFiles(x86)%\ASAP Utilities\ASAP Utilities.xlam

The following applies to versions 8.1 and older. (Starting from version 8.2 the below files no longer use a Win32 API call.)

  • English
    %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_en-us.xlam
    %AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_en-us.xlam
  • German
    %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_de-de.xlam
    %AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_de-de.xlam
  • Spanish
    %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_es-es.xlam
    %AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_es-es.xlam
  • French
    %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_fr-fr.xlam
    %AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_fr-fr.xlam
  • Italian
    %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_it-it.xlam
    %AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_it-it.xlam
  • Dutch
    %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_nl-nl.xlam
    %AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_nl-nl.xlam
  • Portuguese (Brazil)
    %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_pt-br.xlam
    %AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_pt-br.xlam
  • Russian
    %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_ru-ru.xlam
    %AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_ru-ru.xlam
  • Chinese (Simplified)
    %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_zh-hans.xlam
    %AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_zh-hans.xlam
  • Japanese
    %ProgramFiles(x86)%\ASAP Utilities\resources\ASAP_Utilities_ribbon_ja-jp.xlam
    %AppData%\ASAP Utilities\resources\ASAP_Utilities_ribbon_ja-jp.xlam

%LocalAppData%\...\Content.MSO\ and .tmp file

In case it still doesn't work with the above exceptions and you get a warning with a reference to a randomly named .tmp file in the %LocalAppData%\Microsoft\Windows\INetCache\Content.MSO\ folder, then you need to update Windows Defender because it's something that Microsoft has already solved.
Excel creates those randomly named .tmp files every time it opens a file with macros (such as the ASAP Utilities.xlam file, it is not limited to only ASAP Utilities). Those .tmp files are not created by ASAP Utilities.
We recommend to turn on "Cloud-delivered protection" in Windows Defender:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus

In case it then still doesn't work:
Microsoft provided the following recommendation to one of our clients, which successfully resolved the problem:
We found that it was necessary to add an exclusion in the ASR rules, for this path:
%localappdata%\Microsoft\Windows\INetCache\Content.MSO\*.tmp

Resources