False positive (VBA macro)

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

False positive (VBA macro)

L0 Member



We are developer and reseller of XLSTAT, statistical add-ins for Excel, based on VBA macro.


One of our customers used your anti-virus and XLSTAT is detected has a malware. Of course, it is not a malware and we have it installed on more than few thousands of computer without a problem. 

Please, find the message of the anti virus:


Application information:
Application name: Microsoft Excel
Application version: 15.0.4919.1000
Application publisher: Microsoft Corporation
Process ID: 5888
Application location: C:\Office 2010 64 bit\Office15\EXCEL.EXE
Command line: "C:\Office 2010 64 bit\Office15\EXCEL.EXE" "C:\Program Files\Addinsoft\XLSTAT\XLSTAT.xla"
File origin: Hard drive on this computer
User name: NIBIO\LiPa

Prevention information:
Prevention date: 28. mai 2018
Prevention time: 10:06:53
OS version: 6.1.7601.
Component: Local Analysis
Traps code: c0400056
Prevention description: Suspicious macro detected
Additional information 1: C:\Program Files\Addinsoft\XLSTAT\XLSTAT-DIS.dll
Additional information 2: 8DC0F1C5B7A31388A31A4CCDB1DE6D7B93E5F835D3EC2C0DA47B4142A47C4365
Additional information 3: 84FC071FC11584545DE6AE7104DFBE611D60673EF21FD1A5E16E6F025C28A773
Additional information 4: 1



Are you able to clarify the situation and add an exception, please?




L4 Transporter

Do you have the VT link to the suspected false verdict because the hashes that you have listed don't seem to be listed as malicious.



Thank you for your answer.

I haven't another information.  Please, see the attached screenshot from my customer image.png

I see that Traps alert.  If your customer is a Palo Alto Networks customer they need to open a Support case.  This forum is exclusively for Virus Total False Positives for non-Palo Alto Networks customers.

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!