search

todxx / teamredminer

AMD GPU Optimized Cryptocurrency Miner
958 stars 204 forks source link

Windows Recognizing Wacatac Trojan #485

Open joesmitty45 opened 2 years ago

joesmitty45 commented 2 years ago

Opening the start_eth_4gb.bat, Windows reported it as a Wacatan Trojan. Presumably, this is a false positive, right? 🤣😅

UselessGuru commented 2 years ago

False positive.

pdieppa commented 2 years ago

You need to add TRM directory as an exception to your anti-virus to work properly.

escozul commented 2 years ago

On some rigs Windows Defender correctly recognised teamredminer as a "cryptocurrency miner" and quarantined it. You only had to allow it and restore the exe file and you were good to go. What worries me is that on one particular miner It gave me 2 warnings. One was the cryptocurrency miner quarantine and one was the wacatac ransomware trojan (Trojan:Win32/Wacatac.A!ml). Why would the false positive on this device report ransomware?

So I ran a virustotal on it: https://www.virustotal.com/gui/file/b3644783d0458ae5543222114fa6182ee9410069ed20a1eb5f6a3962597213fb

Take it with a grain of salt. Most detections point to a "crypto miner". Teamredminer.exe is most definitely a cryptocurrency miner.

Can't see it being reported as ransomware. The actual exe file can be infected on your installation so I'd suggest running a virustotal to make absolutely sure.