Threat detected ... xlsm files blocked by windows

[GHRyunosuke]

Since today, I kept getting the following alarm by Windows and xlsm file are blocked (SeleniumVBA version 5.8, I use it in the way by copying all the cls files into my own xlsm file)... not sure if this only happens to me or others as well. latest version 5.9 also being detected as malware.

[GCuser99]

It's probably not just happening to you. I'm assuming that you are using MS Windows Defender? I cannot test right now because I'm temporarily using another AV program and can download and run the SeleniumVBA.xlsm file without any problem.

We will probably just have to wait this one out just like all of the others in the past. Since you are building your own trusted macro file by copying code from the class modules, you could tell Defender to make an "exclusion" for your trusted macro file.

As a shot in the dark, I removed some code and references that I know some AV programs do not like and placed them here. You could download both of those and see if either or both get tagged as a (false) positive. The first one has a few code lines removed but should function (except for SendKeysToOS which I know that you use). The second one won't run at all because I dereferenced VBScript's RegExp. These are for testing only - don't integrate them into your codebase.

Let me know what you find out.

Mike

[GHRyunosuke]

Thanks for the advice.
Yes, it is MS Windows Defender again which is annoying... and some of my backup xlsm files are not detected even though they all have the same version 5.8 inside. Hope I could wait this one out soon.
And as for the 2 files you provided above, both could be opened successfully, no false positive.

[oscarsun72]

MY TextForCtextWordVBA.dotm is also . This should be MS Windows Defender's problem! And associated with SeleniumBasic maybe.

https://www.virustotal.com/gui/file/4987005e1a29a83cd1e73b8b1df5e72b312c7d7413dc502fa029967d077ba5ab

Let me exclude it from the items to scan, just like Google Driver :

I tried to fix or repair Office and restart my Windows 10, hope this works. Or I'll have to rename this file to let MS Word Startup with this .dotm file.
Unfortunately！ Not worked! ……

感恩感恩　讚歎讚歎　南無阿彌陀佛　讚美主

[GCuser99]

Weird - the usual whack-a-mole... I just reinstalled Windows Defender v1.421.733.0 (using Malwarebytes before) and no false positives on my system.

@GHRyunosuke - what is your update process exactly? Do you download SeleniumnVBA.xlsm and then copy the class files from that to your working .xlsm?

Does Defender detect anything wrong with the SeleniumVBA.xlsm (v5.9)?

Or is the problem just in your working file?

[GHRyunosuke]

As of now, when i am writing this post, i tried to download version 5.9 (the zip file) again.
As soon as the file is downloaded, i got a warning popup window and when i click it here is the details i got...

i.e. i just downloaded the zip and i have not yet do anything

[GHRyunosuke]

To summary:

1. At both my home and working PC, when i try to download version 5.9, i got warnings above (my working PC does futher to delete the zip file immediately).
2. At my home PC, my existing xlsm files (version 5.8) is working just fine.
3. At my working PC, some of my existing xlsm files (version 5.8) got blocked/deleted and some of the same file (i copied as backupfile) are working fine, which is weird...
4. All weird things above, started to occur since today.

[GCuser99]

Thanks for the details. I can confirm that downloading the zip file is causing a false positive for Windows Defender. But if download just the SeleniumVBA.xlsm by itself from the dist folder, it downloads and works fine. Same with the SeleniumVBADLLSetup.exe. If I download that by itself, it works fine too.

Can you try to download just the SeleniumVBA.xlsm file?

[GHRyunosuke]

Sure, I tried to download just the SeleniumVBA.xlsm file this time via the following webpage.
As soon as it is downloaded, I get a warning popup window at the lower right corner, saying "Microsoft Defender found virus threat..." and the file is deleted immediately.

Download:

Warning:

[GCuser99]

Strange that it is not happening to me. Hopefully will go away soon.

One other question on your upgrade process...

When you upgrade normally, do you download the zip from the release page and then import the source text files (.cls and .bas) into your working .xlsm? I'm asking because I think I am going to add individual files to the release assets and I want to know what would be most useful to you. That way you and others can easily download just what you need, instead of the whole repo in a zip file. Here is a list I am thinking about adding to release assets:

SeleniumVBA.xls
SeleniumVBA.accdb
SeleniumVBADLLSetup.exe
all_vba_source.zip

Thanks,

Mike

[GHRyunosuke]

Hello Mike,

I think adding new release assets as you mentioned above is a great idea.

So far i upgraded in the way of copying all the .cls files and WebShared.bas into my own xlsm file.

However, due to the above issue that I cannot download the zip file, I tried to download only the "SeleniumVBADLLSetup.exe" file (no virus detected) and execute it and then deleted all the *.cls file in my xlsm files and the DLL solution worked just fine! --> I guess afterward I will just use this DLL solution instead. --> BTW, for the DLL solution to work properly, do I need to keep the WebShared.bas in my xlsm?

Above new release asset will fit for those who need either of the 2 ways above, while avoiding possible virus detection.

[GCuser99]

Hello Mike,

I think adding new release assets as you mentioned above is a great idea.

So far i upgraded in the way of copying all the .cls files and WebShared.bas into my own xlsm file.

However, due to the above issue that I cannot download the zip file, I tried to download only the "SeleniumVBADLLSetup.exe" file (no virus detected) and execute it and then deleted all the *.cls file in my xlsm files and the DLL solution worked just fine! --> I guess afterward I will just use this DLL solution instead. --> BTW, for the DLL solution to work properly, do I need to keep the WebShared.bas in my xlsm?

Above new release asset will fit for those who need either of the 2 ways above, while avoiding possible virus detection.

No, you don't need anything else - the ActiveX DLL is a self-contained solution. Yeah the error reporting is still an issue, but I'm expecting that Wayne of tB will fix it soon. I reported it right after @dornech created the issue - thanks @dornech.

I use the ActiveX DLL for my work but like @dornech was doing for a while, when I have a difficult issue, I'll go back to the .xlsm file to debug. Hopefully that will happen less often once the errors are reported correctly.

[GHRyunosuke]

With years of experience with SeleniumVBA, i guess I could solve most common issues without specific error descriptions :)

Admire the creators of SeleniumVBA & tB, awesome job!

[dornech]

Thanks again for all the efforts spent on SeleniumVBA.

I remember I had the false positive virus warning problem with one of the most recent versions, probably 5.8 as well ... I think I manually de-quarantined the downloaded ZIP. I have no urgent need to update, so I probably will stay some time with 5.8 for osme more time ...

Regarding the DLL solution preferred by myself initially I have to confess that I switched to the VBA solution. The reason is the known issue with the strange error message - but I understood this is an issue of TwinBasic.

[GHRyunosuke]

Hello @dornech

As for the "known issue with the strange error message", do you happen to have a link to that issue?

[dornech]

Sure. #121

[GHRyunosuke]

Thank you, let's hope TwinBasic gets it solved soon...

[GCuser99]

Wayne of twinBASIC is a one man show but the amount of progress thus far (still in Beta but nearing v1.0) is astounding. There have been many tries in the past to build VB7 (compatible with VBA7), but this looks like maybe hopefully the first to really succeed. That is part of the reason why I'm using tB and supporting the effort ($$) - I really would like to see him succeed!