topic False positive (VBA macro) in VirusTotal

False positive (VBA macro)

damien_trut — Mon, 28 May 2018 08:19:54 GMT

Hello,

We are developer and reseller of XLSTAT, statistical add-ins for Excel, based on VBA macro.

One of our customers used your anti-virus and XLSTAT is detected has a malware. Of course, it is not a malware and we have it installed on more than few thousands of computer without a problem.

Please, find the message of the anti virus:

Application information:
Application name: Microsoft Excel
Application version: 15.0.4919.1000
Application publisher: Microsoft Corporation
Process ID: 5888
Application location: C:\Office 2010 64 bit\Office15\EXCEL.EXE
Command line: "C:\Office 2010 64 bit\Office15\EXCEL.EXE" "C:\Program Files\Addinsoft\XLSTAT\XLSTAT.xla"
File origin: Hard drive on this computer
User name: NIBIO\LiPa

Prevention information:
Prevention date: 28. mai 2018
Prevention time: 10:06:53
OS version: 6.1.7601.2.1.0.256.1
Component: Local Analysis
Traps code: c0400056
Prevention description: Suspicious macro detected
Additional information 1: C:\Program Files\Addinsoft\XLSTAT\XLSTAT-DIS.dll
Additional information 2: 8DC0F1C5B7A31388A31A4CCDB1DE6D7B93E5F835D3EC2C0DA47B4142A47C4365
Additional information 3: 84FC071FC11584545DE6AE7104DFBE611D60673EF21FD1A5E16E6F025C28A773
Additional information 4: 1

Are you able to clarify the situation and add an exception, please?

Regards,

Re: False positive (VBA macro)

tsullivan7 — Tue, 29 May 2018 13:34:06 GMT

Do you have the VT link to the suspected false verdict because the hashes that you have listed don't seem to be listed as malicious.

Re: False positive (VBA macro)

damien_trut — Tue, 29 May 2018 14:30:30 GMT

Hello,

Thank you for your answer.

I haven't another information. Please, see the attached screenshot from my customer

Re: False positive (VBA macro)

tsullivan7 — Tue, 29 May 2018 17:55:40 GMT

I see that Traps alert. If your customer is a Palo Alto Networks customer they need to open a Support case. This forum is exclusively for Virus Total False Positives for non-Palo Alto Networks customers.