For some time, WordMath has been flagged as malware by various antivirus programs. This is a false positive, meaning the antivirus software incorrectly identifies WordMath as malicious.
The program download may also be blocked by browsers like Chrome.
What causes this problem?
The exact cause is unknown, but antivirus programs scan files using AI, sandboxes, and heuristic analysis. One of these scans likely triggers a malware alert. This is probably because VBA add-ons, like WordMath, are essentially programs embedded in Word documents. Since VBA add-ons can be exploited to distribute malware, antivirus programs tend to be highly sensitive to this type of software and may flag code patterns or techniques commonly associated with malicious behavior.
WordMath is a complex program that employs various methods, some of which can also be used for malicious purposes, such as:
Calling external programs (e.g., running Maxima on Mac)
Opening web links in a browser (e.g., for updates)
Downloading files from the internet (e.g., checking for updates, downloading GeoGebra)
Custom message boxes (which could be mistaken for impersonation attempts)
Custom webview browsers (for executing CAS GeoGebra)
Communication with external custom API DLLs (for Maxima communication)
Multiple attempts have been made to adjust code methods and techniques, but these changes have had little impact on antivirus detection.
The increasing number of global cyberattacks likely explains why antivirus programs are becoming more aggressive in their detection mechanisms.
Interestingly, not all versions of WordMath are affected, despite sharing nearly identical code. However, all recent versions are consistently blocked.
What can you do?
You have two options:
Manually allow WordMath to run:
Exempt the file from antivirus scans. Every antivirus program and browser has a way to do this, but the exemption must be manually configured on each machine.
If the download is blocked, try an alternative browser. For example, Microsoft Edge typically does not block the download.
Sign up for a Partnership:
Partnership with Eduap grant your school or organization access to code-signed files. Code signing increases trust with most antivirus programs and reduces the likelihood of false positives. While not foolproof, care is taken to ensure Microsoft Defender allows the software to run.
