Trojan:Script/Wacatac.B!ml in build

Unity Engine
1

Hi.

I’m generating a build for my game. Before today I had no problems. With Unity 2020.2.4 I’m getting:

Trojan:Script/Wacatac.B!ml detected (Windows 10, the internal antivirus).

I’m looking for solutions to the problem, I’ll let you know if I find any.

2 Likes
2

That’ll most certainly be a false positive.

I run up to date legit Windows 10 and use the built in Windows Defender. My version is Unity 2020.2.4f1 (64-bit)

And there are no trojan notifications.

If you are getting this, perhaps list the packages or addons you use?

3

I didn’t add any new packages or assets, in fact this is a game that is being ported from iOS to Windows, deleting the iOS features and adding Steam features (steamboards etc). I’ll try to see if there is something about this, thank you.

4

I think it’s just false positive. To clarify, do you only get this during a build?

5

Trojan:Script/Wacatac.B!ml threat description - Microsoft Security Intelligence

See if any of the AVs on VirusTotal bring up anything: VirusTotal

You could also submit your game build to Microsoft, should this be a false positive: Submit a file for malware analysis - Microsoft Security Intelligence

.

6

Yes, only the build is detected as a trojan.

7

I’ll do that thank you.

8

I have uploaded the build to VirusTotal.com and no trojans detected anywhere. So the build is ok, I have added an exception to the Windows security antivirus. Thank you.

9

Update: I downloaded the new version of Windows Defender file and now it is ok, the exe is not being considered a trojan.

10

Getting this right now with 2020.3.9f1 on windows 19

11

Having the same issue SINCE 2020.3.9f1, i have 2020.3.10f1 and has the same problem.
(Windows 10 legit full updated)

12

Same crap. I think it began after today’s update Virus’ & threat protection. The day before all builds were successful.
Bill, fix it pls, or Unity can produce an apk affected by trojan viruses :hushed: ?

13

I had the same thing, though I did have a certain multiplayer plugin added. What I did was to install the latest version of Unity. When I imported the game into that, and built it, no more problems. Not sure if it was the new version or recreating the library that did it.

1 Like
14

I’ve just experienced the same problem, Windows Defender claims it found Trojan:Script/Wacatac.B!ml in a RAR archive I created from a fresh build created with Unity Editor 2022.2.11f1. The build itself has no issues, the warning pops up as soon as I create an archive from it.

Legit Windows 10, WinRAR downloaded from their official website (free version for personal use), I did not install any special packages in Unity, it’s a prototype built from the “empty 3d project” template with just a few C# scripts and 1 texture file I created myself.

Even if this is a false positive (neither Windows Defender nor Malwarebytes find anything suspicious on my hdds when running a full scan), it’s very annoying because like that I don’t feel like I can safely send the archive to my frineds for testing. I’d really like to know if this is a Unity problem, or a WinRAR problem, or a hiccup in Windows Defender’s detection heuristics.

15

I’m also experiencing this issue, fresh build from 2020.3.37f1 packed into a RAR and it is flagged right away by Windows Defender. I ran Malwarebytes as well, no concerns found. I’ve reproduced it nearly a dozen times now

edit: from YourGameNameHere_Data, if I navigate to the Managed folder, and delete “UnityEngine.WindModule.dll” then windows defender takes no further issue with the RAR

2 Likes
16

Multiple of my players have this problem with my game downloading it through steam. All at roughly the same time without any changes on the game. Using 2021.3.27f1

Any things I can try?

17

Oh its

Trojan:Script/Sabsik.FL.B!ml

for me.

18

Faced with this Trojan problem
I made a project with version 2021.3.26f1 lts, after the build, I threw the exe file to the virustotal website
The site showed the presence of the Trojan Sabsik.FL.B!ml

Deleted all versions of unity

Installed the latest version at the moment 2022.3.2f1 lts
Copied the project to a separate folder and compiled the project in 2022.3.2f1 lts for architecture 64
I threw the exe file of the build to the virustotal site - The site showed the presence of Trojan.Psw.jmeter
Without changing anything in the project, I compiled the project in 2022.3.2f1 lts for architecture 32! to another folder
I threw the exe file of the build to the virustotal site - the site showed the presence of a Trojan.Malware.300983.sysgen and W32.AIDetectMalware

Am I generating Trojans? )

For the sake of experiment, I removed the assembly on the 64 architecture and compiled it again for the 64 architecture
I threw the exe file of the build to the virustotal site - The site showed the presence of Trojan.Psw.jmeter !!!

I 'm in shock )

19

Not sure but it could be related to