[False Positive] GoFSH Package Trojan:Script/Wacatac.B!ml detected

[markussaage 762]

@rivit

Hey folks,

after a scan with the Windows Defender through my SC4 files, I got an virus alert about the

Trojan:Script/Wacatac.B!ml

in an old GoFSH Package_2.9.6.zip -> GoFSH Package_2.9.6.msi file.
I never had it installed, so I'm certain, that my PC is not, never was infected. But the fact, that there might be a Trojan horse in one of the files, a lot of people might use, got me alerted.
Or is that a false positive? Microsoft Defender removed that file from my system, and as I said, I've never even used it.

I know, that the newest version of the GoFSH Package is now 3.61. Is that file safe to use?

Kind regards!

[rivit 3,391]

I'm confident that's a false positive too. The defender scanner did have a period of tripping over .NET executables and this version 2.9.6 is now quite old. The current version hasn't had any reports of infestation - the way things are today everyone would have yelled out. Thanks for the alert.  

By way of info - Windows can be finicky about software with low distribution numbers. It always takes the 'block before disaster' strategy on new stuff and will often block software it hasn't seen before.  In these cases you need to tell it where to go...

  Edited March 3, 2021 by rivit  
was too quick to hit send

[rsc204 21,806]

This certainly isn’t a unique occurrence, all sorts of files get incorrectly flagged, for no better reason than because any installer could if coded too, cause many problems. More than likely (since it’s MS here), there is a security vulnerability that was found in .net that affected the version this app was made with. Rather than present you with this information and recommend finding a newer ‘fixed’ version, it presents the very attack on their vulnerability as the problem. Just better PR to tell you you’ve malware I suppose? Don’t you feel protected, thank you Microsoft.

What all this comes down to is trust, do you trust the uploaded of the content? Do you trust the sites hosting it, it would be unthinkable that we didn’t scan newly uploaded files for nasties.

I for one have probably used more versions of GoFSH than anyone other than Rivit. Never did I once get a virus from doing so or anything worse than the odd bug in the application. I am certain there is nothing really lurking in the download. 

[markussaage 762]

Hey,

I'm sure, you did. I am certain, that it was a false positive, and I've never had a chance to use it, so... I think I'm good.

I just wanted to let you guys know, just in case.

Your help is highly appreciated!

Kind regards!