Trojan:Win32/Wacatac.B!ml Solved

Question

Hello,

Following a download, I received an alert for the Trojan Trojan:Win32/Wacatac.B!ml. Windows Defender apparently blocked it, but I have been experiencing slowdowns since then.

Here are the FRST64 files:

FRST: https://pjjoint.malekal.com/files.php?id=FRST_20220129_d14x14n9r10p11
Addition: https://pjjoint.malekal.com/files.php?id=20220129_f11h139e5l8

Thank you for your assistance
Have a nice day

MisteryBean · Accepted Answer

Hello,

The detection comes from something you downloaded, do you know what it is? (in bold)

Name: Trojan:Script/Wacatac.B!ml
ID: 2147735503
Severity: Critical
Category: Trojan
Path: file:_C:\Users\Admin\Downloads\theme.js

--
Security Contributor.

sims06 · Answer

Hi, this is a file for a theme for a website. However, VirusTotal indicates that the file is not dangerous.

g3n-h@ckm@n · Answer

Hello, little remark:

the detection engine of Windows Defender/Microsoft is a real disaster, it says nonsense for anything.

my disinfection tools are also detected as "wacatac!" on Virustotal by Microsoft, while when I upload the file with the name of the detected infection, they tell me they can't reproduce the detection in their labs.......Great Microsoft! ^^

Have a nice day :)

--
If I Was to walk away From you my love Could I laugh again? If I Walk away from you And leave my love Could I laugh again? Again, again...

sims06 · Answer

Hello,  Apart from that, is there anything in the reports that could explain the slowdowns?  Thank you :)

MisteryBean · Answer

RE_

Other than that, is there anything in the reports that could explain the slowdowns?

We need to do things in order, for now, we are focused on detection, so do you still have detection?

---------------
-----------------------

Test your hard drives and give the result (color and status) or post a screenshot: https://forums.cnetfrance.fr/tutoriels-logiciels-et-applis/487485-tester-son-disque-dur-ou-ssd-avec-crystaldiskinfo

--
Security Contributor.

sims06 · Answer

Hello,  No, I no longer have the detection. I just ran a test on the hard drives, and they are in "good" condition and blue in color. Thank you!

MisteryBean · Answer

OK, redo a FRST scan and post the new reports  -- Security contributor.

sims06 · Answer

Re,  Here are the new reports:  FRST: https://pjjoint.malekal.com/files.php?id=FRST_20220201_u7v6j14n14p5 Addition: https://pjjoint.malekal.com/files.php?id=20220201_e10q12p8f10c7  Thank you!

MisteryBean · Answer

RE_

--> Copy what is here: https://textup.fr/611277xf from start:: to end:: (without pasting it anywhere)

--> Open FRST (or FRST64) as an administrator and click on Fix
If FRST seems to get stuck or not respond, let it run

--> The fix will clean the firewall, programs you run afterwards will ask for access on the first launch

--> A fixlog file is created in the same location as FRST, post it

--> Let me know if you still have the problem.

sims06 · Answer

Hello,  Here is the fixlog: https://pjjoint.malekal.com/files.php?id=20220202_y9t9g15n5y7 I feel like it's much better, thank you!

MisteryBean · Answer

RE_

System files have been repaired:

Windows Resource Protection found corrupt files and successfully repaired them.

To verify:

--> In Cortana/search, type CMD
--> Right-click on Command Prompt and run as administrator
--> In the prompt, type (or copy/paste) DISM /Online /Cleanup-image /Restorehealth and hit enter
--> Let the scan complete to 100%
--> At the end of the scan, type sfc /scannow and hit enter
--> Let the scan complete to 100%
--> Take a screenshot of the result

--
Security Contributor.

sims06 · Answer

Hi,  I did that and I got the message: The Windows Resource Protection program found no integrity violations.  Thanks again :)

MisteryBean · Answer

RE_

So it's all good ;-)

To finish:

To automatically delete all files/folders created by FRST and the tool itself, rename FRST/FRST64.exe to uninstall.exe and run it.

The procedure requires a restart

Good continuation

--
Security contributor.

sims06 · Answer

Re,  Thank you again for the time spent :)

Trojan:Win32/Wacatac.B!ml

14 réponses

Canon mb5350 - cartridge replacement impossible

Texture issues in enshrouded

Football manager (club management game)

Select next line csh foreach

Win32 kamso then rootkit detection

Win32:spyware-gen [trj] detected by avast

Unknown video error on the freebox player

Make it or break it

How to open a cbr file

Please log in with manager privileges.