Jump to content

False Positive Excel cmd copy "Exploit payload process blocked"


RockyScott

Recommended Posts

I have a macro in Excel that backs up my workbook every time I save it. It does this by creating a date-time-stamped version of the workbook just saved using the command:

C:\WINDOWS\system32\cmd.exe \c Copy E:\Users\Papa\Documents\Development\Modeling\Compressor\nz1\nz1 Develop Performance for Chiller Model.xlsm E:\Users\Papa\Documents\Development\Modeling\Compressor\nz1\History\2017-06-19\nz1 Develop Performance for Chiller Model 2017-06-19_08-55-58.xlsm \v

This causes Excel to stop instantly. This is unacceptable. Should I get rid of MalwareBytes?

Attached is the report. Here are the guts of it:

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Malware.Exploit.Agent.Generic, , Blocked, [0], [392684],0.0.0

-Exploit Data-
Affected Application: Microsoft Office Excel
Protection Layer: Application Behavior Protection
Protection Technique: Exploit payload process blocked
File Name: C:\WINDOWS\system32\cmd.exe \c Copy E:\Users\Papa\Documents\Development\Modeling\Compressor\nz1\nz1 Develop Performance for Chiller Model.xlsm E:\Users\Papa\Documents\Development\Modeling\Compressor\nz1\History\2017-06-19\nz1 Develop Performance for Chiller Model 2017-06-19_08-35-40.xlsm \v
URL: 

Excel Blocked.txt

Link to post
Share on other sites

Thank you for your quick reply. I don't know why I didn't see that before.

Also, with the hope of making it seem more secure by AV software, I changed my code from a Shell command:

    l_strShellCommand = _
          Environ("Comspec") & " /c Copy """ _
        & l_fsoFile.Path & """ """ _
        & l_strDestinationFileFullPathAndName _
        & """ /y /v"

    Shell l_strShellCommand

to a 100 % FileSystem object method (which I suspect will be considered more secure by AV software):

    l_fsoFile.Copy (l_strDestinationFileFullPathAndName)

 

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.