onsen-chinatsu said:
Just throwing a PSA, but Wacatac.X!ml (replace X with another letter) is a very
very common false positive. Notice the "ml" right near the end? That stands for "machine learning". It means that Defender never encountered this "virus" before but they tagged it as such thanks to the dataset they're learning on. Usually, AV software detect viruses through:
- Signature - the AV scans your file against their database and searches for a similar copy of known viruses or malware
- Behavior - the AV detects when a file seems to do some sketchy stuff such as trying to send large amount of data through the net or trying to delete your System32 folder
- Heuristics - the AV flags a file as a "possible" virus based on similarities with previous viruses
In our case, Defender is using heuristics-based detection for our file and they flagged it as a trojan thanks to its "experience" through ML/AI. I don't know the exact specifics of it, but Defender has a
raging boner as of late for tagging some archived files like our Nope_Nope_Nope_Nope_Nurses.7z as "Wacatac.B!ml". If you're brave enough you could try extracting the .7z file and scanning the folder. Most of the time, Defender will react to the .7z but will sleep on the actual folder. That's how it was from what I experienced a few months ago from various .zip files. Though, there is a chance it will still react to something in the folders but from my scan, I really didn't catch anything.