Yesterday, 9 March 2021, Windows Security started preventing me from saving the VBA in my Normal.dotm and Personal.xlsb files.

When this occurs, the content of Normal.dotm and Personal.xlsb is destroyed by Windows Security. The affected file (e.g. a typical spreadsheet) could be saved; but, the concurrently running Personal.xlsb would not save. If I cancel the save, and restart the office application (e.g. Excel), the Personal.xlsb file would open; but all its code would have disappeared. The same behavior occurs using Word and Normal.dotm. The problem exists on all of my machines that include this code or earlier versions of it.

This is particularly insidious because backup copies of files containing the code are similarly destroyed without warning when used. These backups were functional when they were saved months ago. If I open those, the code is instantly removed and the file size shrinks from something significant (e.g. 2000KB) to something like 8KB.

I deleted the Personal.xlsb and Normal.dotm files and allowed O365 to recreate them by recording a trivial macro. I could then re-import the code using MZTools; but, could not save the repopulated Personal.xlsb or Normal.dotm files. O365 would return ". . . cannot complete the save due to a file permission error".

By trial and error, I narrowed the cause of the problem to one comment and a series of statements. If I eliminate the comment and the statements, the files can save normally. The 'offensive' comment explains a longish Print statement that is used to construct a .bat file used to uninstall (i.e. delete) the files used by my application from a folder on the user's hard drive.

The strange thing is that even the comment alone is enough to trigger protective action by Windows Security. The 'offensive' comment is:

' forfiles /p "c:\temp\Folder A" /c "cmd /c del c:\temp\Folder B@file"

If I turn off Real-time protection, I can function normally; but, as soon as I turn it back on, the problem resumes.

Actions taken to mitigate the issue include; but, are not limited to:

* Ran the free version of Malwarebytes and did not find any infections.
* All settings in W10 Windows Security are on.
* W10 is fully updated.
* 32-bit O365 (Desktop) is fully updated.
* 64-bit Dell Laptop is fully updated.

I've noticed a lot of updates to Windows 10 during this period and I've made a concerted effort to assure W10 and O365 are fully updated on all of our machines. The problem persists.

I suspect that an overeager Windows Security is scanning for a pattern of text similar to "del c:" and then throwing everything away just "to be sure to be sure".

The purpose of my code is to create an UnInstall.bat file. This file uses the forfiles command to look at the list of files in a specified folder in a shared location and then deletes similarly named files in a specified subfolder of %APPDATA% on the user's hard drive. A separate Install.bat file takes care of the installation; but, the code creating that file has not caused an issue. Please note that the VBA procedures creating the UnInstall.bat and Install.bat files have NOT been exercised during this period. Neither have the UnInstall.bat and Install.bat files been executed in recent memory.

I'm new to distributing software and this is my attempt to do so with the tools and skills that I have. I have not experimented with allowing Windows Security to restore or allow the action anyway; but, that would be a major obstacle to providing a simple update feature to my application as it stands.

Any suggestions? Work around?

Thanks

Bruce