VBA best practices to avoid virus false positives?

[MagnusNovak]

Hi everyone,

I have an excel spreadsheet that I share online with a variety of users. The excel spreadsheet is pretty complex and also includes some VBA. It seems like my VBA frequently triggers false positives from antiviruses as well as windows itself (which blocks all macros by default and send warning messages), creating issues to share the spreadsheet. Typical AV culprits are VirusTotal (a website that tests files through dozens of antivirus apps) and, more annoyingly, Gmail (which won't let me send the spreadsheet by email sometimes).

So I was wondering if there were any best practices I should follow when working on files with VBA? I can't remove the VBA itself because it's absolutely necessary to the spreadsheet, but maybe I can find and rework certain things that have a higher chance of triggering antiviruses.

On a related note, do you think paying for a digital certificate from a third party would help with building trust for the file and reducing issues when sharing it?

Thanks

[TMS]

To be honest, I doubt that the content or complexity of the code is a factor. I suspect that it is simply the fact that it is there is the issue.

Windows now adds a level of security to files that are downloaded or emailed for the protection of the recipient. Any file with suspect content will be marked as blocked. This is so that the recipient can, and should, check the content before unblocking it.

Files that I download from the forum that do not have code are not blocked. Those that do, are blocked.

You could try zipping the file(s) up. I don't know how many layers the anti-virus software will peel away in order to check the content.

Or, a more tedious option: you could export all the code to .bas files and send them as text, alongside the "bare" spreadsheet, with instructions on how to re-import the code modules.

I've never used a digital certificate so I can't comment on that. You would hope that the AV software (and windows) would be capable of reading and accepting the certificate. But I wouldn't spend a lot of money without checking it out.

Google: free digital certificate

[MagnusNovak]

Thanks, appreciate the suggestions.

The .bas file approach is unpractical because a lot of my users are not "tech savvy" (i.e. they barely know the difference between Excel and Google Sheets), so I can't imagine putting them through that.

The zip approach could be interesting, I need to do some tests to see if it helps!

Yes, definitely need to to some additional research about certificates, hopefully, that can help with this whole issue!

Thanks again

[TMS]

You're welcome.

[Artik]

In addition to the standard macro blocking that depends on settings in Excel itself, antivirus programs can report a threat if Win API functions are used in the code. It doesn't matter then that you're using the code for a good purpose, because the antivirus doesn't analyze all the code to consider it safe (or not). Win API function declarations alone are enough to raise an alarm. The antivirus can only report an alarm for certain declarations of these functions, those that are used by pests to attack your computer.
Macro blocking can be changed in the Options settings. Antivirus alarms can be blocked (hopefully in all AV programs) by adding the name of a file and/or folder to a "whitelist."

Zipping files is not an obstacle for AV programs these days. Certainly at the first level of packing AV is able to analyze the code. As Trevor mentioned perhaps there is a certain limit of packing depth above which AV no longer analyzes code. But deeper than that, beyond the first level, I have never checked.

I also have no experience with digital signatures, but it certainly reduces the difficulty of running the file on the target user's computer.

Artik