cancel
Showing results for 
Search instead for 
Did you mean: 
FVAL
Level 7
Report Inappropriate Content
Message 1 of 8

Excel macro flagged as threatening

Jump to solution

Hi,

For a web application I am working on, we need to write excel macro that are triggered when an excel file is opened (to perform modification on the way data is displayed). 

This is done to fulfill a requirement from one of our customer. 

This customer is using your VirusScan Enterprise (VSE) product, and unfortunately, our macros are flagged as threatening by your solution, meaning that the file cannot be downloaded and opened. 

The following link from virus total shows the analysis of our file :

https://www.virustotal.com/gui/file/9998e31eb78ed395ed61071e5b1ab9421ff048fd796ab664a39b86b203ece6dc...

I cannot attach to this ticket the error displayed by your solution or the excel file that is triggering the error. How can I provide you those ?

Could you please see if there is a way to white list our macros as they should not include any harmful code.

P.S.: We cannot ask our customer to whitelist the file in your solution as it is generated with a random name.

1 Solution

Accepted Solutions
McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 8 of 8

Re: Excel macro flagged as threatening

Jump to solution

Hi @FVAL 

Apologies for the delay in response. Just keeping the post updated as well. I would like to confirm that the False Positive detection is suppressed and there should be no more detection on the file. For anyone else looking for a method to contact support for False Positive, being a non-McAfee user, you can always contact us via our Customer care team and obtain a temporary grant# that should help you reach our support team in the future.

I sincerely hope this helps!

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
7 Replies
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 2 of 8

Re: Excel macro flagged as threatening

Jump to solution

You can submit the whole file to us by raising a "Malware" support case with us and submitting the file as a sample via the SR. I would suggest reading KB85567 as it gives you detailed steps on how to do this and what requirements are needed for a successful submission.

If the file has already been quarantined you can submit the quarantined file to us as the sample.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
FVAL
Level 7
Report Inappropriate Content
Message 3 of 8

Re: Excel macro flagged as threatening

Jump to solution

Unfortunately, I cannot see the description of the steps to follow on the KB85567 you are referring too because I cannot expands the items.

I am using the latest version of Chrome. 

McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 4 of 8

Re: Excel macro flagged as threatening

Jump to solution

Hi @FVAL 

Thanks for highlighting this to us. I would suggest creating a Service request with us with the hash value of this file. Based on the Virus Total link you have shared, It's MD5 seems to be: de4c441b9dd486ad56a19a205afc5cd3.

I can confirm we have this specific sample with us - should save you some time in uploading it. Please open a Service request with us via your support portal or using your grant# by calling our support line and we should be able to get this advanced to our Labs team to check this further.

The final decision of deeming it as a legit detection or a False positive and white-listing it will be made by analyzing the sample we have available with us. Please be reminded that we are doing this for 1 file and one specific version of it, meaning, should an upgrade to the macro change it's hash orit's behavior, it may get detected again.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
FVAL
Level 7
Report Inappropriate Content
Message 5 of 8

Re: Excel macro flagged as threatening

Jump to solution

I am not one of your customer, thus, I don't have a support portal or a grant# to provide. I am doing this on the behalf of one of my customer, who is one of your client. 

In addition, I am completly lost to where to declare this. Could you please provide a simple and working link to where I can submit my request.

 

Thanks in advance for your time.

FVAL

McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 6 of 8

Re: Excel macro flagged as threatening

Jump to solution

Ah! My apologies for the previous response. In case of non availability of Grant#, I am sure this should help you:

To submit a sample using email, send it to McAfee Labs Virus Research at: virus_research@avertlabs.com.

  • Prefix the email subject line with the word FALSE. For example:

    FALSE: In-house file detected by McAfee
  • Example of information to provide: 
Please review the submitted file as we think this detection is a false positive detection.

Product: VirusScan Enterprise 8.8 and Endpoint Security
DAT version: 3833 and 9382
Engine: 6000
Description of issue: A one line description should do.
 
NOTE: Failure to supply all information requested above could result in delays with the analysis. Except the description part, please leave the other details as it is!
 
  • The sample must be in a password-protected .zip or .7z file. RAR and other formats are not processed.
  • The .zip file must be a single level. Do not include .zip files within the .zip file, with or without password protection, and do not include folder structures that are more than one level deep. Not following these requirements can cause samples to not be processed.
  • The file extension of the password-protected .zip file must be .zip or .7z. Any other extensions, or lack of an extension, cause the sample to not be processed.
  • When creating the .zip file, do not use AES or other types of encryption available from the program; use only a password for protection.
  • You must use the word infected as the password for the .zip or .7z file. Any other password causes the sample to not be processed.
Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 7 of 8

Re: Excel macro flagged as threatening

Jump to solution

Hi @FVAL ,

Thank you for your time here. I shall get the False Positive Submission done and get back to you with an update on this. This should take a while as Labs do not have a specific ETA for this. I shall message you in private and keep you updated about this. Hope this makes it easier for you!

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 8 of 8

Re: Excel macro flagged as threatening

Jump to solution

Hi @FVAL 

Apologies for the delay in response. Just keeping the post updated as well. I would like to confirm that the False Positive detection is suppressed and there should be no more detection on the file. For anyone else looking for a method to contact support for False Positive, being a non-McAfee user, you can always contact us via our Customer care team and obtain a temporary grant# that should help you reach our support team in the future.

I sincerely hope this helps!

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community