Repository navigation
Replies: 32 comments 28 replies
|
Repeated twice, same result
|
|
test6 and test7 changed to no dictation
|
|
test 6 detected in version1.421.1222.0
|
|
For unknown reasons, SeleniumVBA.xlsm v6.4 is no detection in Defender.
|
|
So weird and random! Thanks @hanamichi77777! I'll add your excellent addition to the table above... |
|
BTW @GHRyunosuke, apparently, according to @hanamichi77777's latest report, if it were not for your SendKeysToOS "attack vector", version 6.4 would be flagged as a false positive! 🤣🤣 |
|
VBScript became on-demand from Windows11 version 24H2. |
|
Interesting. I think it should, but I have not tested it that way. Not sure exactly what is removed if VBSCRIPT is disabled. |
|
Thank you. It has been confirmed that VBScript.Regex is invalid. |
|
It should be enabled by default in this phase, according to the official MS timeline: and I can confirm that it's enabled, even without a checkbox to disable it, on my Windows 24H2:
|
|
Thank you. |
|
Thanks for testing it @hanamichi77777! |
|
Thanks for reporting this @hanamichi77777. I transferred it as an issue to @Sihlfall's vba-regex repo. If you find any more issues with vba-regex, it may be more expedient to post them there if you want to. One thing to keep in mind is that I made that class wrapper as a quick solution for testing, since I could just drop it in all of my codes without making any changes, thus minimizing commitment until well-enough tested. So far it worked in all of my use cases. But the wrapper is REALLY MUCH SLOWER than @sihlfall's "static" module version. So you may want to consider using the syntax for the faster original version once you are satisfied with testing. I may do that eventually. |
|
I guess the wrapper is slower since you initialize the regex on each function call. That's not necessary unless the pattern or case-sensitivity changes. See this class wrapper, which can be built with Or do you mean the StaticRegex is faster even if you need the regex only once? |
@sihlfall, I was referring to iterating through a large number of matches and sub-matches using the class wrapper that I made versus your static module. I'll look at stdRegex3 to see if there is anything in there that would help with efficiency. Thanks! |
|
@GCuser99 All you have to do is to define as a member variable of your class module and make sure it is initialized with when an object is created. See here. Yet there I use Sancarn's Of course, this only helps if you are indeed initializing the Regex more than once. It depends on what you are doing. In the Regex engine, I avoid creating strings and rather work with (start, length) pairs whenever possible, since I noticed that strings are comparatively expensive in VBA. |
|
I updated the false positives table and sorted from latest to oldest. Thanks again to @hanamichi77777 for the help. What is really interesting in the latest (June 6th, 2025) is that the only false-positive detection is the test where we replaced VBS's RegExp with StaticRegex! I guess it might be because there is more VBA code for the heuristics to be confused by... Anyway, it appears as though we are in a false-positive quiet period for the .xlsm version. We still have not experienced a false-positive detection yet for the .accdb and DLL versions (knock on wood!). |
|
The results are as follows.
|
|
That is strange @hanamichi77777... Look at top of this discussion - I updated the table with results from 1.431.139.0 before your last post and only test 2 had a false positive. I just tried again with 1.431.150.0 and got the same results as I did for 1.431.139.0! |
|
I'll try it again. |
|
I repeated this three times with 1.431.151.0, but the results are disappointing in my environment.
|
|
Thanks for tripple checking! Weird that you nearly got the opposite results as I did! Back to drawing board... |
|
I repeated this three times and got good results with 1.431.183.0.
|
|
I repeated this three times and got good results with 1.431.188.0.
|
|
I repeated this three times and got good results with 1.431.199.0.
|
|
I repeated this three times and got good results with 1.431.266.0.
|
|
I experimented with regular expression alternatives (VBA-dotNET-regex(@6DiegoDiego9) and vba-regex).
|
|
Unfortunately, test1 has become unstable.
|
|
Unfortunately, even the official version 6.6 of Defender still gives false positives. Added. |
|
How to download safely without being detected by Defender
The above process can be automated using VBA. |
|
Currently, there is no way to ensure that it will not be detected.
(Addition) |
|
That is very interesting! Are you setting the password for the Workbook, or for the VBA project? |
|
Thank you. |
|
Thank you for uploading the book with a password.
|
|
From @SanbiVN on an unrelated issue: To avoid Virus detectors: I never use the prefix: VBA. in the code. When I enter a URL into the code, I usually mess it up a little bit. Public Const hoops = "ht" & "t" & "ps://" In your project most of the libraries are declared early, I think it is not necessary. Those are the avoidances that I usually do in my project. |
|
Replace URLDownloadToFile: Declaration early: A mistake written in the keyword taskKillByImage = wsh.Run("taskkill /f /t /im " & taskName, 0, True)Try the following or convert to a byte array: taskKillByImage = wsh.Run("ta" + "sk" & "ki" + "ll /f /t /im " & taskName, 0, True)Prefix URL string: |
|
"Byte array or XOR encoding": WinHTTP auto-proxy via VBA-Web: "http" and "https" strings detection: |
|
I agree about the likelihood of triggering heuristic detections with some of these techniques. In fact, VirusTotal is flagging SeleniumVBA.xlsm as containing obfuscation of some kind. Anyway, unless we have strong empirical evidence that a given change(s) significantly reduces the chances of false-positives, I'd prefer not to obfuscate. |
|
Currently there are no false positives with WinInet API, we'll have to wait and see how it goes.
4/65 is as follows (10/11/25) Update
|
|
The test1 +WinHttpRequest5.1＋WinHttp API remains No Detection.
WebDriver's download behavior is sensitive, so VirusTotal's score cannot be reduced to zero, but Defender's false positives have not occurred. |
|
I can also add that all the versions I’ve tested over the past few days, including the one you attached here, don’t trigger any antivirus/blocks during the following actions:
|
|
The following is from Copilot. |
|
I asked Perplexity Pro (C. Sonnet 4.5 Thinking) to prepare the email message and search the email/form to submit the false positive report to these 4 AV vendors. Do you agree with the message text? |
|
Yes, I agree with message text. |
|
Done. Email sent to the 4 AV vendors. I was unable to download the SeleniumVBA.xlsm file currently published because I get "virus detected" on download with Edge: 
|
|
Thanks for sending Diego. Which Defender version were you using when attempting to download? |
|
Windows Defender Antivirus 1.439.308.0 (20/10/2025) |
|
Just updated to 1.439.332.0 (21/10/2025) and now it passed! |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
More and more lately, SeleniumVBA has been flagged with antivirus false positives. This is not surprising given the complexity and functional breadth of our code. Multiple times in the past I've experimented by randomly removing/changing various code blocks, but it has been difficult to isolate the problem(s) on a one-off basis. Additionally, it seems that satisfying Window's Defender heuristics is a moving target, as there are times when the EXACT same code is fine one day, and then flagged on another, and then back to being ok later. Additionally, the MS Excel version of SeleniumVBA can be flagged, but the EXACT same code in MS Access is ok.
I think it's time to try a more structured longer-term approach. From v6.2 onward, we will test av false positives in this GitHub folder. There I have created several functionally "reduced" test versions of SeleniumVBA.xlsm. To start with, I've removed/replaced some functionality that I know MalwareBytes real-time protection does not like but will test other code changes in the future as well.
The table below summarizes the functionality removed from each test:
Below is a table for tracking false-positives over time - I will update this table with hopefully help from some of you going forward:
If you have issues downloading and/or using the latest release version, then please try one of the test versions, and then report your experience in this discussion thread so that we can track and hopefully determine a strategy that reduces the number of false positives in the future.
Thanks!
All reactions