FXserver 5874 - Trojan:Win32/Wacatac.H!ml

[pp2amd6]

Important parts

What is the issue you’re having? In FXserver build 5874, Windows Defender found Trojan:Win32/Wacatac.H!ml

What are you trying to do? start server

What have you tried already to fix the issue? Nothing

Error screenshot (if any):

What did you do to get this issue? Downloaded the latest build (currently 5874) from the repository, unzip and run

What server did you get this issue on? Be specific and name some, ‘all of them’ by itself isn’t useful! Local server

---

Additional comments

Previously, none of the versions of FXserver had such problems.

[system]

Hello, this is a friendly reminder because this is your first time creating a topic (or it has been a while since your last topic) in this category.

Please note that most of the support is provided by the Cfx.re community on a voluntary basis. We ask you to be patient; there is no guarantee we have a solution to your problem(s). To avoid unnecessary/duplicate topics, please browse the forums before creating a topic.

To improve your chances of your issue(s) being solved, please provide as much information as possible about the issue(s) you are having. Also —whenever possible— please use the template given to you when creating a topic.

Thanks for keeping these forums tidy!

[nta]

@pp2amd6

Trojan:Win32/Wacatac.H!ml

Known false positive which Microsoft’s antivirus has pop up every so often and refuses to properly fix.

Here’s some more examples:

• Windows Defender reporting for Trojan:Win32/Wacatac.D!ml when building runtime · Issue #35167 · dotnet/runtime · GitHub (Microsoft’s own product, LOL)
• Contains Trojan:Win32/Wacatac.B!ml · Issue #2900 · fatedier/frp · GitHub
• Windows Defender Detecting Trojan:Win32/Wacatac.B!ml in ACNH Poker Release188.zip · Issue #30 · MyShiLingStar/ACNHPoker · GitHub
• Trojan:Win32/Wacatac.B!ml detected in processhacker-3.0.4021-bin · Issue #882 · winsiderss/systeminformer · GitHub

For now, this has been submitted to MSRC again and probably will be fixed in a few days, until next time…

I feel that if they know this detection is broken so much, they ought to at least remove the slanderous text saying ‘this program is dangerous and executes commands from an attacker’.