Wacatac.H!ml found by Microsoft Defender but not anything else

Wisewiz · Mar 26, 2023

This has been very interesting. Yesterday, I reported (here) that my copy of CrystalDiskMark64 had triggered a "Severe" trojan threat warning from Defender, and MBAM flagged it, too. MBAM quarantined it, and I deleted the files in MBAM.

Downloaded another copy, and the same triggers fired on both Defender and MBAM. Scrapped that copy of the software.

I have a copy on my other machine that has never triggered a threat warning, so I copied the files of that one to the "threatened" machine, and now all is well. Defender and MBAM scans are both clear. I have run CrystalDiskMark64 (portable) about ten times on the "threatened" machine now, and no flags have gone up.

If this trojan is, in fact, real, it's an odd trojan, to say the least. It didn't affect anything else on my machine, and all it took to get completely rid of it was deleting the source. Hmmm.

See also: CrystalDiskMarkPortable64: Trojan reported here

kelper · Mar 26, 2023

My advice would be to be wary of portable apps not offered by the app's author. And certainly to be wary of mirrors.

Lamberto Vitali · Mar 26, 2023

glasskuter said:
if it is a portable app that Defender will not let you exclude at the file level, try putting it in a folder and see if Defender will let you exclude the folder. If that doesn't work, put it on a flash drive and disable Defender before you run it.

It's detecting the test files on the device I'm testing, I cannot exclude it.

glasskuter said:
I would think the app creates it's file in a folder somewhere whenever it is run. Surely it uses the same folder each time. Usually such apps create a folder in appdata. Just exclude that folder the app created.
OR
Turning off defender before you run the app should correct your problem since the app will create a new file each time it's run if its previous file has been removed. After Defender is turned back on, the next time it scans your computer it will remove the suspicious file from the 'whatever' folder, but the app will create it again the next time you use it. (as long as Defender is turned off at the time)

I am not willing to turn it on and off every 5 minutes.

Fabler2 said:
Yup Defender flagged up the threat but I allowed it. Still scanning.

View attachment 56403

I allowed it too. It found it again the next time I ran it. The second time I said allow, but defender dozed off.

Fabler2 said:
Just submitted the file to Ms (me not being lazy for a change)

View attachment 56406

I didn't see a way to do that. AVG presents me with a button to report.

kelper said:
Perhaps it depends where you downloaded it? I suggest OP uninstalls it and gets a fresh copy straight from the horse's mouth.

I've been running it for a year and it's not detected by AVG, or indeed defender until the latest update. I find it hard to believe tit's a real virus sat there for a year doing no noticeable damage and MS only just spotting it.

quartzdoll said:
wacatac virus even caught in wordweb dictionary app by Microsoft defender. just install other antivirus of your choice or ignore defender threats. i never care defender threats at all. i just exclude important folders from defender and move on. use virustotal.com if something feels like virus. defender is a joke.

Easiest just to install another AV program so defender is disabled.

SlicEnDicE said:
Windows defender is actually way better than most AVs out there. But sometimes it is a bit "too good".

Too good is not good, it's bad. Like saying my car is really safe because it only goes 30mph.

SlicEnDicE · Mar 27, 2023

Lamberto Vitali said:
Too good is not good, it's bad. Like saying my car is really safe because it only goes 30mph.

Speed has nothing to do with this.

I'd rather get a few false positive every now and then, than not finding some infections or suspicious files. Once an infection gets foothold, it may be a matter of seconds before all data is gone, and not to forget stolen passwords and session tokens. May take months to recover from such disaster, and it could cost millions.

Lamberto Vitali · Mar 27, 2023

SlicEnDicE said:
Speed has nothing to do with this.

I never said it did, that was an analogy!

SlicEnDicE said:
I'd rather get a few false positive every now and then, than not finding some infections or suspicious files. Once an infection gets foothold, it may be a matter of seconds before all data is gone, and not to forget stolen passwords and session tokens. May take months to recover from such disaster, and it could cost millions.

Finding actual viruses with names is all I want. Whenever it gives it a generic name, it's just the heuristics guessing. I happen to use a lot of suspicious programs. Many of the Boinc science projects are suspicious, merely because they download other executables. Cracked software always triggers AV. Bitcoin wallets too.

SlicEnDicE · Mar 27, 2023

Lamberto Vitali said:
Cracked software always triggers AV. Bitcoin wallets too.

Nope, mostly not...except when they actually contain malware. Nether does Bitcoin wallets.

Lamberto Vitali · Mar 27, 2023

SlicEnDicE said:
Nope, mostly not...except when they actually contain malware. Nether does Bitcoin wallets.

Incorrect. My gridcoin wallet just triggered AV - the new installer for the update released yesterday.

Cracks always contain "malware". AV programs think that sort of tinkering is wrong. They are altering the code in another executable I suppose.

SlicEnDicE · Mar 27, 2023

Lamberto Vitali said:
Incorrect. My gridcoin wallet just triggered AV - the new installer for the update released yesterday.

And you're 100% certain it is a false positive?

Lamberto Vitali said:
Cracks always contain "malware". AV programs think that sort of tinkering is wrong. They are altering the code in another executable I suppose.

Incorrect! With background in studying, reverse engineering and cracking small apps for educational purposes during my assembly and security studies, I can 100% guarantee that you're completely wrong.

Always is a too strong word here.

SlicEnDicE · Mar 27, 2023

Only AV trigger I have had in the past 9 years, is one single file, and this is a 5.5MB Zip file which I know contains malware. It is a study file.

Lamberto Vitali · Mar 27, 2023

SlicEnDicE said:
And you're 100% certain it is a false positive?

Gridcoin is not a virus.

There are fake bitcoin apps which do work for other people, to earn them coins from your electricity. The AV has difficulty telling them apart.

SlicEnDicE said:
Incorrect! With background in studying, reverse engineering and cracking small apps for educational purposes during my assembly and security studies, I can 100% guarantee that you're completely wrong.

Always is a too strong word here.

English isn't that precise. And it depends on how fussy the AV is. Presumably most cracks alter the program's executable, they're patches. that tends to trigger AV. Of course some just replace an executable.

Wacatac.H!ml found by Microsoft Defender but not anything else

𝐒𝐩𝐞𝐚𝐤𝐬 𝐀𝐧𝐜𝐢𝐞𝐧𝐭 𝐆𝐞𝐞𝐤

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer