Windows Defender found trojan "Wacatac.h!ml" during today's update

[Lisq33]

Before reporting your issue

• I have confirmed that this issue does not happen when ExplorerPatcher is not installed
• I do not have "register as shell extension" enabled
• I have tried my best to check existing issues

Repro ExplorerPatcher versions

it's in polish language

Repro Windows Versions

Windows 11 Home 25H2

3rd party tweak software installed

none

Describe the bug

.

Expected outcome

.

Actual outcome

.

Additional info

No response

Crash Dumps

No response

Media

No response

[mattritchie]

Came here to find out if this has been reported already. got this too.
WIN11 25H2
Version 10.0.26200 Build 26200

Not registered as shell extension

[joebcytek]

https://www.virustotal.com/gui/file/f689c068d61e7339efc6eba266d9674b41c5ef96dff0cc90ab0ff80c11a84ae8?nocache=1

Virus Total shows these sites detected current patch as malware:
Antiy-AVL - Trojan/Script.Agent
DeepInstinct - MALICIOUS
GData - W0in64.Riskware.ExplorerPatcher.B
Microsoft - Trojan:Win32/Wacatac.B!ml
SecureAge - Malicious
Trapmine - Malicious.moderate.ml.score

[FreeWeeFee]

Got this as well when I updated today.

Version 10.0.26200 Build 26200

[ReSsanFR]

Good evening. So, out of doubt and fear, I uninstalled it using Revo Uninstaller Pro. What about you—what did you do?

[alan-alvarez404]

Going to hold on updating my version of explorer patcher until this is resolved.

[pyrates999]

submit it as a false positive to Microsoft: https://www.microsoft.com/en-us/wdsi/filesubmission

[pyrates999]

I just did that.

[raymondjpg]

Restore threat, then disable SAC in order to install.

[vmdasilva]

Same here, but in Symantec Endpoint Protection.
Name: update for explorerpatcher from https꞉∕∕github.com∕valinet∕explorerpatcher∕releases∕latest∕download∕ep_setup.exe
Risk: SONAR.SuspBeh!gen615
Action: In quarantine
I have submitted as a "false positive" in Broadcom Symatec Enterprise Division, I hope this helps, or the release of a new patch will be appreciated.

[Amrsatrio]

Hi all. Sorry for the trouble. This thing usually happens with unsigned software like this one. Give it couple more days and the issue will resolve. I had to put this out of pre-release state early due to the severity of upcoming Windows updates that caused the previous version to crashloop explorer and the start menu.

But I guess I'll have to demote this release until it is resolved.

If you trust me, as the sole maintainer of this software today, it is not malware (depending how you look at it) as long as you get it from this repository and the builds are performed in GitHub's actions runners, which is the case for all releases here since 2022.

Thank you for your understanding.

[pyrates999]

I already submitted it:

It is no longer considered a trojan.

[vmdasilva]

Broadcom Symatec Enterprise Division has removed the setup file:
https꞉//github.com/valinet/explorerpatcher/releases/latest/download/ep_setup.exe
From is threats database a few minutes ago. If you have Symantec Endpoint Protection antivirus, you can now install the new version of ExplorerPatcher without any problem.

[pyrates999]

Please check if it's because version 26100.8457.70.1 was set back to a pre-release and the previous release is now the current release 26100.4946.69.6.

[vmdasilva]

I have already updated to version 26100.8457.70.1 without any problem, with Symantec Endpoint Protection activated and working.

[Znuff]

Hi all. Sorry for the trouble. This thing usually happens with unsigned software like this one. Give it couple more days and the issue will resolve. I had to put this out of pre-release state early due to the severity of upcoming Windows updates that caused the previous version to crashloop explorer and the start menu.

But I guess I'll have to demote this release until it is resolved.

If you trust me, as the sole maintainer of this software today, it is not malware (depending how you look at it) as long as you get it from this repository and the builds are performed in GitHub's actions runners, which is the case for all releases here since 2022.

Thank you for your understanding.

I don't think you should dismiss things as simple as that.

There have been numerous supply chain attacks in the last few weeks/months, so people are very cautious with warnings about compromised software - as they should be.

We can't dismiss the possibility that your own account hasn't been compromised, or, even worse, the whole build pipeline could be compromised.

I'm not accusing you, mind you, just stating the reality of the situation.