VB.net desktop Forms App //Trojan:Win32/Wacatac.B!ml

~OSD~ 2,126

Hi,

I have created a VB forms application. Surprisingly it was detected as Malware by Windows Defender. This app was created a while ago, but recently it was counted as :

Trojan:Win32/Wacatac.B!ml

User's image

Any thoughts?

Jiachen Li-MSFT 26,506 Reputation points Microsoft Vendor

2024-03-26T10:01:16.0933333+00:00

May I know if you have any updates about this problem?

1 answer

Jiachen Li-MSFT 26,506 Reputation points Microsoft Vendor

2024-03-19T01:31:32.16+00:00

Hi @~OSD~ , If this is an safe app you've developed and you think you've encountered an incorrectly detect as unsafe you may submit sample to Submit a file for malware analysis - Microsoft Security Intelligence.

The link below provides a way to temporarily eliminate false positives.

How can I know if Wacatac.B!ml is a false positive or it's a real positive?

Best Regards.

Jiachen Li

If the answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
~OSD~ 2,126 Reputation points

2024-03-20T11:15:25.0566667+00:00

@Jiachen Li-MSFT thanks for reply.

Yes, initially it was working fine, and this strange behavior just poped-up now.

Will check the links you have provided. But is it normal that on the same PC visual studio is installed and creates the exe file, Defender claims it as harmful software?

Jiachen Li-MSFT 26,506 Reputation points Microsoft Vendor

2024-03-21T08:52:37.4566667+00:00

Hi @~OSD~ ,

Is it possible that you got this Trojan file from somewhere else?

Try running your app on a different computer to test it.

The problem may not be caused by your app.

Trojan:Win32/Wacatac.B!ml

~OSD~ 2,126 Reputation points

2024-03-26T17:02:55.3266667+00:00

I performed an offline defender test and the scan did not find anything when I copied the exe files from the original PC to a different one.

On the original PC, where it was created, I have quarantined it, should I perform an office scan with Defender on original PC?

Jiachen Li-MSFT 26,506 Reputation points Microsoft Vendor

2024-03-27T02:24:35.0333333+00:00

Hi @~OSD~ ,

It looks like the problem is indeed caused by the Trojan file, and it is recommended that you run a full scan on your PC.

~OSD~ 2,126 Reputation points

2024-03-28T09:33:47.7666667+00:00

@Jiachen Li-MSFT Performed the full scan and it indicated about 500 infected files.

Almost 99% of Visual Studio Projects :(

So, even I re-install the OS, when I copy the VS Projects from old to new installation, it will be same problem.

What might caused this, specifically to Visual Studio?

Any better approach to cleanup the VS projects? I mean without sacrificing the projects?

Jiachen Li-MSFT 26,506 Reputation points Microsoft Vendor

2024-03-28T10:00:15.51+00:00

Hi @~OSD~ ,

At present, this problem is beyond the scope of Visual Studio and VB.net, and it is recommended that you post the problem related to virus removal under the Windows Security related TAG separately.

We can only recommend that you recreate the project and manually add the original code to the new project to avoid the new project being infected.

~OSD~ 2,126 Reputation points

2024-03-28T11:20:02.9666667+00:00

Ok, fair enough. Thanks for the repones.
Sign in to comment