Windows Defender says there is "Wacatac" trojan

Started by Daniel

Daniel

Windows Defender says there is "Wacatac" trojan   26 January 2025, 13:23

After I downloaded NetScanner version 8.2.3 from the official download page, our Microsoft Defender with a paid licence began telling us that netscan.exe file is infected with Wacatac trojan.

When I checked the file in VirusTotal, only ESET said its a virus. Microsoft and all other antivirus vendors were OK. I am aware that ESET is unreliable, but I am concerned about Windows Defender.

Then I asked my colleague to check the file on his computer. His Windows Defender showed "Win32/Wacatac" trojan, and Sophos AV also flagged the file.

Unfortunately we cannot add NetScanner to exclusions/whitelist because Windows Defender is blocking it.
SoftPerfect Support forum - Ann avatar image
Ann

Windows Defender says there is "Wacatac" trojan - False Positive   26 January 2025, 13:34

We understand your concern, and we want to assure you that this is a known issue referred to as a "false positive". False positives occur when antivirus software incorrectly flags a legitimate application as malicious. This can happen to any application, not just out products.

The detection by Windows Defender as "Wacatac" is due to the limitations of machine learning algorithms used by some antivirus programs. If you search online for "Win32/Wacatac" or "Script/Wacatac", you will see that it is frequently associated with false positives.

Network scanning tools often get flagged because they have capabilities that can be misinterpreted by antivirus software. Terms such as "NetScanner", "NetScan", "NetTool", "Hacktool", "Unwanted", "PUA", "Potentially Unsafe", "Riskware" or even "Trojan" are commonly used in these cases. However these tools are instead designed to assist network administrators in maintaining secure and efficient networks. Their purpose is to help network administrators to discover and remove network vulnerabilities before any malicious actor can exploit them.

We recommend submitting netscan.exe file to Microsoft as a false positive detection. This can help improve their detection algorithms and prevent similar issues in the future. Once Microsoft fix their erroneous detection, they should remove the file block as well.

Reply to this topic

Sometimes you can find a solution faster if you try the forum search, have a look at the knowledge base, or check the software user manual to see if your question has already been answered.

Our forum rules are simple:

  • Be polite.
  • Do not spam.
  • Write in English. If possible, check your spelling and grammar.

Author:

Email:

Subject

A brief and informative title for your message, approximately 4–8 words:

     

Spam prevention: please enter the following code in the input field below.

 **    **  **     **  **     **  **      **  ******** 
  **  **    **   **   **     **  **  **  **  **       
   ****      ** **    **     **  **  **  **  **       
    **        ***     **     **  **  **  **  ******   
    **       ** **     **   **   **  **  **  **       
    **      **   **     ** **    **  **  **  **       
    **     **     **     ***      ***  ***   ******** 

Message: