Trojan Horse

[Ruyeex]

I got a Trojan horse because of the website the redirects to another one.
I can't tell why since I don't know what happened, but it's ridiculous despite being the official website.
On mobile, it works fine, but on PC I don't know why.
Link: https://sourceforge.net/projects/pysolfc/files/
OS: Windows 11 Home
Version: 3.2.0

[Ruyeex]

[joeraz]

There is a recurring issue with Python apps falsely being recognized as containing malware. See https://pysolfc.sourceforge.io/faq.html for more info.

[Ruyeex]

That's strange behaviour.
What can we do to fix it?

[joeraz]

All we really can do is report it to the antivirus app as a false positive. Or you can run from source.

I've been trying to come up with a proper solution for years, but haven't got anywhere. It seems to be a problem inherent in compiled Python apps, and probably has to be fixed somewhere higher up.

[THEtomaso]

I reported this as a false positive to Avast five days ago.
..but so far; no response.

[joeraz]

Just to confirm, I reported it to Windows Defender the other day, and they cleared it as safe.

[MidnightStallion]

Just to confirm, I reported it to Windows Defender the other day, and they cleared it as safe.

I just got the latest virus definition updates for Windows Defender, and it is still reporting it as being infected with Trojan:Win32/Wacatac.B!ml

[joeraz]

I just got the latest virus definition updates for Windows Defender, and it is still reporting it as being infected with Trojan:Win32/Wacatac.B!ml

Here's what Microsoft told me:

Please follow the steps below to clear cached detections and obtain the latest malware definitions.

 1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender 
 2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
 3. Run "MpCmdRun.exe -SignatureUpdate"

Alternatively, the latest definition is available for download here: https://docs.microsoft.com/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus

Thank you for contacting Microsoft.

If that doesn't work, you should probably try submitting the file yourself at https://www.microsoft.com/en-us/wdsi/filesubmission

[MidnightStallion]

Thanks, joeraz. Following the command line instructions you gave worked. It is not being reported as infected anymore.