After I downloaded NetScanner version 8.2.3 from the official download page, our Microsoft Defender with a paid licence began telling us that netscan.exe file is infected with Wacatac trojan.
When I checked the file in VirusTotal, only ESET said its a virus. Microsoft and all other antivirus vendors were OK. I am aware that ESET is unreliable, but I am concerned about Windows Defender.
Then I asked my colleague to check the file on his computer. His Windows Defender showed "Win32/Wacatac" trojan, and Sophos AV also flagged the file.
Unfortunately we cannot add NetScanner to exclusions/whitelist because Windows Defender is blocking it.
SoftPerfect Network Scanner
Windows Defender says there is "Wacatac" trojan
Started by Daniel
Daniel
Windows Defender says there is "Wacatac" trojan 26 January 2025, 13:23 |
|
Windows Defender says there is "Wacatac" trojan - False Positive 26 January 2025, 13:34 |
Admin Registered: 11 years ago Posts: 1 015 |
We understand your concern, and we want to assure you that this is a known issue referred to as a "false positive". False positives occur when antivirus software incorrectly flags a legitimate application as malicious. This can happen to any application, not just out products.
The detection by Windows Defender as "Wacatac" is due to the limitations of machine learning algorithms used by some antivirus programs. If you search online for "Win32/Wacatac" or "Script/Wacatac", you will see that it is frequently associated with false positives.
Network scanning tools often get flagged because they have capabilities that can be misinterpreted by antivirus software. Terms such as "NetScanner", "NetScan", "NetTool", "Hacktool", "Unwanted", "PUA", "Potentially Unsafe", "Riskware" or even "Trojan" are commonly used in these cases. However these tools are instead designed to assist network administrators in maintaining secure and efficient networks. Their purpose is to help network administrators to discover and remove network vulnerabilities before any malicious actor can exploit them.
We recommend submitting netscan.exe file to Microsoft as a false positive detection. This can help improve their detection algorithms and prevent similar issues in the future. Once Microsoft fix their erroneous detection, they should remove the file block as well.
The detection by Windows Defender as "Wacatac" is due to the limitations of machine learning algorithms used by some antivirus programs. If you search online for "Win32/Wacatac" or "Script/Wacatac", you will see that it is frequently associated with false positives.
Network scanning tools often get flagged because they have capabilities that can be misinterpreted by antivirus software. Terms such as "NetScanner", "NetScan", "NetTool", "Hacktool", "Unwanted", "PUA", "Potentially Unsafe", "Riskware" or even "Trojan" are commonly used in these cases. However these tools are instead designed to assist network administrators in maintaining secure and efficient networks. Their purpose is to help network administrators to discover and remove network vulnerabilities before any malicious actor can exploit them.
We recommend submitting netscan.exe file to Microsoft as a false positive detection. This can help improve their detection algorithms and prevent similar issues in the future. Once Microsoft fix their erroneous detection, they should remove the file block as well.