Website blocked due to trojan - false positive - www.excelhero.com

[grayminds]

Hi - How do I get more information on why Malwarebytes is flagging www.excelhero.com as having a trojan?  I'm friends with the owner (Daniel Ferry) and am trying to help diagnose why it was flagged.

Thanks,

Michael.

[TeMerc]

45 minutes ago, grayminds said:

Hi - How do I get more information on why Malwarebytes is flagging www.excelhero.com as having a trojan?  I'm friends with the owner (Daniel Ferry) and am trying to help diagnose why it was flagged.

Thanks,

Michael.

Hello- Live threat here: VirusTotal - URL - 15ec3ff48303f34ce993eef6de01b58c2093237763bf5ae4dd602ef0ce48b638

File analysis here: VirusTotal - File - 30cc0dc3636fcb332852d6d763d0bd6146e17c698e932ae05e295a719c954b96

[grayminds]

Thanks - now can you translate this?

My vague reading on this is that your system is complaining about an excel file (it is an advanced excel/macro training site), but don't identify which file.

What is the "necessary action" to stop being negatively flagged?

Thanks,

M.

[thisisu]

On 6/29/2022 at 2:05 PM, grayminds said:

Thanks - now can you translate this?

My vague reading on this is that your system is complaining about an excel file (it is an advanced excel/macro training site), but don't identify which file.

What is the "necessary action" to stop being negatively flagged?

Thanks,

M.

Hi,

I'll try to clarify. There is a file on the domain at this location:

 

http://excelhero.com/blog/workbooks/multithreaded_vba_excelhero.com.xls

In this case, the file name is multithreaded_vba_excelhero.com.xls

Can you or the webmaster of the site delete it and let us know please? When that happens we can unblock the domain from being flagged.

[grayminds]

My question is what is the problem with this file?  You might have improperly classified legitimate code (Daniel is an Excel MVP with Microsoft) as a trojan.  More details are needed than just deleting a file that is used as part of training.

[thisisu]

Hello,

Yes, It does look like a false positive. Sorry about that. It will be unblocked in the next database update :)