Wacatac.H!ml found by Microsoft Defender but not anything else

I was running a program called H2testw, which does a disk scan of USB memory sticks. Suddenly Microsoft Defender began preventing it reading back it's test files, claiming they were infected with Wacatac.H!ml, but this has never happened before, I've used the program for about a year with no problems. I told Defender to scan the whole computer, and nothing was found anywhere else. The USB stick or H2testw was creating the virus somehow. I tried a different known good stick incase I'd received a dodgy stick, but it found it there too. I put AVG on instead, and it claimed there was nothing wrong on any of them. What gives?

Most anti-malware programs use a system called heuristics (as well as scanning for the thousands of known defined malware) where certain "rules" will trigger a result. Not all antimalware programs are the same.

In the case of this result

Most of those results suggest it's a virus. One (from reddit) says it's usually false positive.

Ridiculous thing number 1: it was a test data file to see if the USB stick read it back correctly. Not code at all.
Ridiculous thing number 2: Microsoft Defender didn't let me ignore it.

Defender removed, permanently, it's as rubbish as it always has been. It used to only detect a third of known viruses, now they've gone too far the other way. Typical MS, redesigning until it breaks. Back to AVG we go.

Lamberto Vitali said:

Most of those results suggest it's a virus. One (from reddit) says it's usually false positive.

Ridiculous thing number 1: it was a test data file to see if the USB stick read it back correctly. Not code at all.
Ridiculous thing number 2: Microsoft Defender didn't let me ignore it.

Defender removed, permanently, it's as rubbish as it always has been. It used to only detect a third of known viruses, now they've gone too far the other way. Typical MS, redesigning until it breaks. Back to AVG we go.

Click to expand...

Might want to give Bitdefedner free a try... I've been using their paid version for 10 years.

Lamberto Vitali said:

Back to AVG we go.

Click to expand...

Surely you jest. AVG over even Defender ??? A pointed stick through a USB port would be more effective at digging out malware.

AVG has served me well for over a decade. Someone suggested Defender had been improved. It hasn't. What on earth makes you think AVG is no good? It has detected and removed every virus I've ever seen on 100s of computers I've sorted, most of them where someone's paid Norton hadn't bothered updating for over a year.

Lamberto Vitali said:

Back to AVG we go.

Click to expand...

I totally agree with @idgat AVG is a complete resource hog. Many years ago it was pretty good, but now , not so good.
I'd much rather have an AV that will exclude something if it suspects it to be malware ((whether it is or not) than I would having an AV that will pass it.

If you are determined to use it anyway, if it is a portable app that Defender will not let you exclude at the file level, try putting it in a folder and see if Defender will let you exclude the folder. If that doesn't work, put it on a flash drive and disable Defender before you run it.

glasskuter said:

I totally agree with @idgat AVG is a complete resource hog.

Click to expand...

You must have a very slow computer if it hogs resources. This machine has 24 cores, but I also use AVG on 4 core machines. Never seen it take up more than 1 of those cores.

glasskuter said:

Many years ago it was pretty good, but now , not so good.
I'd much rather have an AV that will exclude something if it suspects it to be malware ((whether it is or not) than I would having an AV that will pass it.

Click to expand...

I'm sick of false positives, they're worse than missing something. It's why I would never have a burglar alarm which wakes up the whole neighbourhood every night (like my neighbour's did until I had the police remove it forcefully).

I've never had AVG let anything through. And AVG's false positives I can exclude. Microsoft defender doesn't let you exclude properly, half the time it just dozes off when you tell it to do so.

glasskuter said:

If you are determined to use it anyway, if it is a portable app that Defender will not let you exclude at the file level, try putting it in a folder and see if Defender will let you exclude the folder. If that doesn't work, put it on a flash drive and disable Defender before you run it.

Click to expand...

It's not the app it's detecting, it's the data file it creates to test the USB memory stick's reliability. If I tell it to restore and exclude it, it's too late, it interrupted the scan. And it doesn't stop it detecting the (presumably slightly different) file next time. It prevented me using the test program altogether. Plus, it never actually tells me it's detected anything, until I find a program isn't working right because one of it's files is missing. At least AVG puts up a warning dialog. Out it goes.

I would think the app creates it's file in a folder somewhere whenever it is run. Surely it uses the same folder each time. Usually such apps create a folder in appdata. Just exclude that folder the app created.
OR
Turning off defender before you run the app should correct your problem since the app will create a new file each time it's run if its previous file has been removed. After Defender is turned back on, the next time it scans your computer it will remove the suspicious file from the 'whatever' folder, but the app will create it again the next time you use it. (as long as Defender is turned off at the time)

Odd, the .exe works fine for me and not a peep from Defender. Downloaded it from a link from a TP-LINK site.

Fabler2 said:

Odd, the .exe works fine for me and not a peep from Defender. Downloaded it from a link from a TP-LINK site.

How to Verify Fake Micro SD Cards | TP-Link United Kingdom

How to Verify Fake Micro SD Cards

www.tp-link.com

View attachment 56399

Click to expand...

Did you do a scan and the datafile didn't get marked a virus?

SlicEnDicE said:

Did you do a scan and the datafile didn't get marked a virus?

Click to expand...

Scanning now,

Yup Defender flagged up the threat but I allowed it. Still scanning.

This is similar behaviour to installing FormatFactory. If you know it's from a safe site it's up to the individual what to do but I always get the choice to allow or not.

Just submitted the file to Ms (me not being lazy for a change)

The developer of H2testw is Harald Bögeholz and his email address is hwb@heise.de
H2testw is the official page.

I'm running it now to see if my AV detects a trojan.

kelper said:

The developer of H2testw is Harald Bögeholz and his email address is hwb@heise.de
H2testw is the official page.

I'm running it now to see if my AV detects a trojan.

Click to expand...

VirusTotal unanimously shows it's clean.

Perhaps it depends where you downloaded it? I suggest OP uninstalls it and gets a fresh copy straight from the horse's mouth.

wacatac virus even caught in wordweb dictionary app by Microsoft defender. just install other antivirus of your choice or ignore defender threats. i never care defender threats at all. i just exclude important folders from defender and move on. use virustotal.com if something feels like virus. defender is a joke.

quartzdoll said:

wacatac virus even caught in wordweb dictionary app by Microsoft defender. just install other antivirus of your choice or ignore defender threats. i never care defender threats at all. i just exclude important folders from defender and move on. use virustotal.com if something feels like virus. defender is a joke.

Click to expand...

Windows defender is actually way better than most AVs out there. But sometimes it is a bit "too good".