VB.net desktop Forms App //Trojan:Win32/Wacatac.B!ml

Question

VB.net desktop Forms App //Trojan:Win32/Wacatac.B!ml

~OSD~ 2,201

Hi,

I have created a VB forms application. Surprisingly it was detected as Malware by Windows Defender. This app was created a while ago, but recently it was counted as :

Trojan:Win32/Wacatac.B!ml

User's image

Any thoughts?

Jiachen Li-MSFT 34,221 Reputation points Microsoft External Staff

2024-03-26T10:01:16.0933333+00:00

May I know if you have any updates about this problem?

1 answer

Your answer

Jiachen Li-MSFT 34,221 Reputation points Microsoft External Staff

2024-03-26T10:01:16.0933333+00:00

May I know if you have any updates about this problem?

Answer 1

Jiachen Li-MSFT 34,221 Microsoft External Staff

Hi @~OSD~ , If this is an safe app you've developed and you think you've encountered an incorrectly detect as unsafe you may submit sample to Submit a file for malware analysis - Microsoft Security Intelligence.

The link below provides a way to temporarily eliminate false positives.

How can I know if Wacatac.B!ml is a false positive or it's a real positive?

Best Regards.

Jiachen Li

If the answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

~OSD~ 2,201 Reputation points

2024-03-20T11:15:25.0566667+00:00

@Jiachen Li-MSFT thanks for reply.

Yes, initially it was working fine, and this strange behavior just poped-up now.

Will check the links you have provided. But is it normal that on the same PC visual studio is installed and creates the exe file, Defender claims it as harmful software?
Jiachen Li-MSFT 34,221 Reputation points Microsoft External Staff

2024-03-21T08:52:37.4566667+00:00

Hi @~OSD~ ,

Is it possible that you got this Trojan file from somewhere else?

Try running your app on a different computer to test it.

The problem may not be caused by your app.

Trojan:Win32/Wacatac.B!ml
~OSD~ 2,201 Reputation points

2024-03-26T17:02:55.3266667+00:00

I performed an offline defender test and the scan did not find anything when I copied the exe files from the original PC to a different one.

On the original PC, where it was created, I have quarantined it, should I perform an office scan with Defender on original PC?
Jiachen Li-MSFT 34,221 Reputation points Microsoft External Staff

2024-03-27T02:24:35.0333333+00:00

Hi @~OSD~ ,

It looks like the problem is indeed caused by the Trojan file, and it is recommended that you run a full scan on your PC.
~OSD~ 2,201 Reputation points

2024-03-28T09:33:47.7666667+00:00

@Jiachen Li-MSFT Performed the full scan and it indicated about 500 infected files.

Almost 99% of Visual Studio Projects :(

So, even I re-install the OS, when I copy the VS Projects from old to new installation, it will be same problem.

What might caused this, specifically to Visual Studio?

Any better approach to cleanup the VS projects? I mean without sacrificing the projects?
Jiachen Li-MSFT 34,221 Reputation points Microsoft External Staff

2024-03-28T10:00:15.51+00:00

Hi @~OSD~ ,

At present, this problem is beyond the scope of Visual Studio and VB.net, and it is recommended that you post the problem related to virus removal under the Windows Security related TAG separately.

We can only recommend that you recreate the project and manually add the original code to the new project to avoid the new project being infected.
~OSD~ 2,201 Reputation points

2024-03-28T11:20:02.9666667+00:00

Ok, fair enough. Thanks for the repones.

Share via

VB.net desktop Forms App //Trojan:Win32/Wacatac.B!ml

1 answer

Your answer