+ Reply to Thread
Results 1 to 8 of 8

Trojan mistakenly detected in my spreadsheet

  1. #1
    Forum Contributor
    Join Date
    08-12-2019
    Location
    NYC
    MS-Off Ver
    2019
    Posts
    155

    Trojan mistakenly detected in my spreadsheet

    Hi,

    I've been working on a spreadsheet that contains some VBA. Nothing particular, mostly code that automatically executes goal seek, lock the sheets, etc. So clearly not some high profile VBA code. However, one of my users informed me that a trojan was detected inside the spreadsheet when he uploaded it to Virustotal. Below is the screenshot of the scan result:

    trojan spreadsheet.jpg

    As you can see on the picture, the file is cleared by most antiviruses, except Baidu that detects, for some reason, a "VBA.Trojan-Downloader.Agent.ead". I'm not very familiar with the language so does anyone know what that means? I really don't know which part of the code is causing such issue because everything in my spreadsheet is pretty basic and I don't know what this website is referring to.

    Thanks a lot for you help

  2. #2
    Valued Forum Contributor dotchiejack's Avatar
    Join Date
    05-21-2015
    Location
    Antwerp,Belgium
    MS-Off Ver
    2016
    Posts
    507

    Re: Trojan mistakenly detected in my spreadsheet

    If only one of the scanners of Virustotal detects something it is 99% a False Positive. In this case I am sure this is a False Positive.(or you're lying and you've written a virus)
    Click the * Add Reputation below to say thanks.

  3. #3
    Forum Contributor
    Join Date
    08-12-2019
    Location
    NYC
    MS-Off Ver
    2019
    Posts
    155
    Quote Originally Posted by dotchiejack View Post
    If only one of the scanners of Virustotal detects something it is 99% a False Positive. In this case I am sure this is a False Positive.(or you're lying and you've written a virus)
    Oh it’s definitely a false positive. The problem is more to find out what generates that based on the message indicated by the antivirus. Not familiar with this jargon so I don’t know if there is a way to extract any info from the alert. (Otherwise I’ll have to test all the vba code, piece by piece)

    Thanks

  4. #4
    Forum Expert
    Join Date
    10-02-2014
    Location
    USA
    MS-Off Ver
    2016
    Posts
    1,222

    Re: Trojan mistakenly detected in my spreadsheet

    Were did the file come from? If it was not created by a trusted source then there is a good chance this is a legit result.

    VBA code is not the only way to pass along a malicious payload via an Office file.

    It can be done via external links to a template or data connection for example. It could be done via a named range linking to external content. It could be something that was inserted into the underlying structure of the Excel file (xlsx and xlsm are basically zip files. You can actually rename them from .xlsx/xlsm to zip, open them and see the parts that make them up) that isn't there "naturally".

    Unless you created the file from scratch (or it was created from scratch by a trust worthy source) then you cannot be 100% sure its safe.
    Last edited by Zer0Cool; 02-14-2020 at 04:45 PM.
    Ways to get help: Post clear questions, explain your overall goal, supply as much background as possible, respond to questions asked of you by those trying to help and post sample(s) files.

    "I am here to help, not do it for people" -Me

  5. #5
    Forum Contributor
    Join Date
    08-12-2019
    Location
    NYC
    MS-Off Ver
    2019
    Posts
    155

    Re: Trojan mistakenly detected in my spreadsheet

    Well, I'm the author of the file (started from scratch) so I know for sure that there isn't any Trojans in the spreadsheet. In any cases, it seems like the false positive disappeared after I slightly changed the spreadsheet (by doing any random change so VirusTotal can identify it as a new file), saved it again, and uploaded it on Virustotal again.

  6. #6
    Forum Expert shg's Avatar
    Join Date
    06-20-2007
    Location
    The Great State of Texas
    MS-Off Ver
    2003, 2010
    Posts
    40,678

    Re: Trojan mistakenly detected in my spreadsheet

    In Trust Center, do you have Trust Access to VBA Project enabled?
    Entia non sunt multiplicanda sine necessitate

  7. #7
    Forum Contributor
    Join Date
    08-12-2019
    Location
    NYC
    MS-Off Ver
    2019
    Posts
    155

    Re: Trojan mistakenly detected in my spreadsheet

    Quote Originally Posted by shg View Post
    In Trust Center, do you have Trust Access to VBA Project enabled?
    Yes, I do. The "Trust Access to the VBA project object model" is checked.

  8. #8
    Forum Expert shg's Avatar
    Join Date
    06-20-2007
    Location
    The Great State of Texas
    MS-Off Ver
    2003, 2010
    Posts
    40,678

    Re: Trojan mistakenly detected in my spreadsheet

    That tends to make some virus scanners nervous. Turn it off and see if there's still a problem (aside perhaps from your code no longer working).
    Last edited by shg; 02-15-2020 at 09:31 PM.

+ Reply to Thread

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Solver mistakenly producing "Solver stopped by user" error
    By Scolopendra in forum Excel Programming / VBA / Macros
    Replies: 1
    Last Post: 09-17-2019, 12:02 PM
  2. Word shell32.dll causing Trojan script warnings
    By sparx in forum Excel Programming / VBA / Macros
    Replies: 0
    Last Post: 04-21-2017, 04:26 PM
  3. Replies: 1
    Last Post: 11-08-2009, 06:09 PM
  4. excel tip trojan???
    By rsbadger15 in forum Excel General
    Replies: 0
    Last Post: 05-08-2009, 12:12 PM
  5. Excel mistakenly formats as Scientific Notation
    By JBme in forum Excel General
    Replies: 5
    Last Post: 06-04-2008, 03:37 PM
  6. [SOLVED] The Mossad has created a secret trojan in Excel !!!
    By Paul Eisner in forum Excel General
    Replies: 1
    Last Post: 03-06-2005, 02:06 AM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

Search Engine Friendly URLs by vBSEO 3.6.0 RC 1