trojan script Wacatac.H!ml.

[mark_aldred]

Just in case anybody else encounters this. Windows Defender flagged a couple of VRay dlrs for trojan script Wacatac.H!ml.

Uninstalling VRay, rebooting then reinstalling seems to have fixed it.

[^Lele^]

Uninstalling VRay, rebooting then reinstalling seems to have fixed it.

If those files had been infected, your doing the above would have surely cleaned them.
Your PC may have other issues, be wary.

[mark_aldred]

Will do. Thanks.

[mark_aldred]

Well this is a pain.
Now I'm getting the same warnings for other VRay files. vrayclipper, vrayinstancer, vraymetaball. I tried uninstalling and reinstalling without a reboot (I have a process running I can't stop right now), and windows defender picked the same files up as infected on booting max. Surely this is a false positive?

[Joelaff]

Did you scan your whole drive and see if any other files are showing this infection? It would be odd for malware to infect ONLY VRay (and make me think false positive).

More info here, and a suggestion for testing your binaries online:
https://www.makeuseof.com/windows-wacatac-trojan/

[mark_aldred]

I ran a full scan for a couple of hours and nothing came up. I'm just running another scan of the system drive. Nothing yet.

[mark_aldred]

Did you scan your whole drive and see if any other files are showing this infection? It would be odd for malware to infect ONLY VRay (and make me think false positive).

More info here, and a suggestion for testing your binaries online:
https://www.makeuseof.com/windows-wacatac-trojan/

Thanks for the link. Makes me think it is a false positive. I've done nothing at least on that list that would have got my PC infected.

[mark_aldred]

Bugger it. Defender gives me the warning on a fresh install that I've used many times before. The page you linked gives a negative. I haven't got time for this. I'm adding a folder exception.

Thanks both of you for the help.