search

suurjaak / h3sed

Heroes3 Savegame Editor
MIT License
10 stars 2 forks source link

Trojan Trojan:Win32/Wacatac.B!ml found in Windows executable #7

Closed arnehaese closed 4 months ago

arnehaese commented 4 months ago

Hi,

the executalbles (standalone and the one in setup downloadable on https://suurjaak.github.io/h3sed/downloads.html) are infected with Trojan:Win32/Wacatac.B!ml - you might want to recompile :)

Thx, best, A

suurjaak commented 4 months ago

There is no infection here. It's just that antivirals often get triggered by PyInstaller-packaged executables, apparently since such packaging uses methods that are often also used by actual trojans (PyInstaller has dozens of issues on this: https://github.com/pyinstaller/pyinstaller/issues?q=is%3Aissue+trojan).

The only solution has been to contact those specific antivirals individually and ask them to run a proper full analysis. If and when they have responded, the resolution has always been acknowledging that the detection was a false positive. It's like an endless game of whack-a-mole..

Where did this specific infection report come from? Current reports on www.virustotal.com list a few detections for each of the released binaries, pretty much all of them different and none of them Wacatac.B!ml:

arnehaese commented 4 months ago

Thx for the quick answer - I see, had sth similar some years ago with Autoit automation on Windows, did not guess this could be similar here - sorry for any confusion I might have caused.

Thx a lot, best, A

PS: Great tool!

suurjaak commented 4 months ago

Thank you!

Where did this infection notice come from? If it came from Microsoft Defender or the like, I can try contacting them to run a proper analysis and whitelist the application, because a built-in antivirus flagging the program makes it quite impossible for people to use..

arnehaese commented 4 months ago

Indeed Microsoft Defender on upto date patched Win 11 - thx a lot :)

suurjaak commented 4 months ago

Thank you, I've submitted a false-positive report to Microsoft.

Will keep this issue open for now.

suurjaak commented 4 months ago

So far, so good, screenshot from the Microsoft Security website:

image

Guess we need to wait for a human to look it over.

suurjaak commented 4 months ago

Good news:

Analyst comments:

At this time, the submitted files do not meet our criteria for malware or potentially unwanted applications. The detection has been removed. Please follow the steps below to clear cached detections and obtain the latest malware definitions.

  1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender
  2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
  3. Run "MpCmdRun.exe -SignatureUpdate"

Alternatively, the latest definition is available for download here: https://docs.microsoft.com/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus

suurjaak commented 4 months ago

I will also try using a custom-built PyInstaller for new releases, hopefully resulting in less false-positive reports from antivirals.