Windows form windows defender false positive

Question

0.00/5 (No votes)

See more:

I created a windows form application and when I compile as release and I open the exe windows defender triggers it as a virus called "Trojan:Script/Wacatac.B!ml" and gets removed.

any help would be appreciated.

What I have tried:

I'm not really understanding why it's being detected.

Posted 15-May-21 17:28pm

Aurora51x

Updated 15-May-21 20:20pm

Add a Solution

2 solutions

Solution 1

It may depend on what you're app is doing. If there's any behaviors Defender considers "funny business", that can trigger your app being quarantined.

You can add it to the exceptions list. Start -> Windows Security -> Virus & threat protection -> Exclusion -> Add or Remove.

Posted 15-May-21 18:14pm

Dave Kreskowiak

Comments

Aurora51x 16-May-21 0:16am

It's legitly to type data in textboxes and select options in combobox and it saves it to the settings and allows to load as well.
But I wanna be able to use the program on multiple pcs without having to go and add Exclusion to each pc if I decided to release it for download.

Dave Kreskowiak 16-May-21 0:29am

If you're stuffing keystrokes, you'd doing something suspicious. You cannot get around it without setting exclusions.

Aurora51x 16-May-21 0:31am

What do you mean by stuffing keystrokes. I'm sure there's programs out there that using textboxes and don't have a false postive

Dave Kreskowiak 16-May-21 11:03am

It was an example. Apps can be quarantined not for what's been detected in the executable file, but by the behavior of the app.

Aurora51x 16-May-21 0:33am

and when I go to windows defender and I custom scan and scan the folder files of where the exe and dlls are it comes up with no detection till I download it on another pc it triggers Trojan:Script/Wacatac.B!ml

Dave Kreskowiak 16-May-21 11:04am

Then you might have a virus on your machine. Like OriginalGriff said, go get another virus product and use it to scan your entire machine.

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

OriginalGriff · Accepted Answer · 2021-05-15T20:04:00

Solution 2

Quote:
and when I go to windows defender and I custom scan and scan the folder files of where the exe and dlls are it comes up with no detection till I download it on another pc it triggers Trojan:Script/Wacatac.B!ml

My best guess is: your PC is infected, or the exe has become infected in transit. I'd start by checking your computer with a number of anti-virus products: Trojan:Script/Wacatac.B!ml is several years old so I'd expect them all to find it ...

Posted 15-May-21 20:04pm

OriginalGriff

Comments

Aurora51x 16-May-21 2:08am

Do you know of a good virus scanner that would detect that type of virus. I don't know how I would get a virus I don't download anything from sketchy websites or that cracked or anything.

OriginalGriff 16-May-21 3:16am

Pretty much any of the big ons: Defender, McAfee, Kaspersky, Norton, Bitdefender, MalwareBytes, ... the list goes on. I'd start with "why is my PC not spotting this? What am I running?"

Aurora51x 16-May-21 17:34pm

Thank you OriginalGriff looks like there was a bunch of files from an old antivirus that I had that was hidden and Malwarebytes removed it. And I recompiled the exe and tested through virustotal and no issues and windows defender doesn't catch it as a false positive and doesn't removes it.

OriginalGriff 16-May-21 17:44pm

You're welcome.