Trojan:Win32/Wacatac.H!ml reported by Windows Defender + Virustotal

[tomrex4]

Trojan:Win32/Wacatac.H!ml found in ~\AppData\Local\Temp\onefile_26092_134144399480302398\main.dll

Virustotal scan for the savestate.exe program: https://www.virustotal.com/gui/file/551babddd97e72c750501ee92b1c8369494ad5e2b29d48b970fcc07e0774015f/detection

[Matteo842]

[Matteo842]

[tomrex4]

Hi @Matteo842,

I sadly got another hit:

Trojan:Win32/Etset!rfn

in

file: C:\Users\usr\AppData\Local\Temp\onefile_26528_134143757612788024\main.dll

So are you confirming that these are false positives? Or could these files have been infected somehow?

[Matteo842]

Hi @tomrex4

I completely understand your concern, but I can firmly confirm that these are false positives. I am actively working with antivirus vendors to whitelist the application, and I have already successfully cleared 6 out of 8 previous false detections.

Here is a detailed explanation of why you are seeing this and how you can verify the safety of the file yourself:

1. "Sterile" Build Environment (GitHub Actions) To ensure maximum security, I do not compile the application on my personal computer anymore. The file you downloaded was built using GitHub Actions.

   What this means: GitHub's own servers create the file in a completely clean, isolated, and automated environment. It is impossible for a virus from a personal PC to "infect" the build because the build environment is destroyed and recreated from scratch every time.

2. Digital Signature (Important!) The Windows version of this app is digitally signed via SignPath.

   How to verify: Please check the screenshot I attached below. You can do this on your PC by right-clicking the .exe file -> Properties -> Digital Signatures.

   Why it matters: If the signature is present and valid, it guarantees the code has not been altered or tampered with since it left the GitHub servers.

3. Verify the Code Yourself (Open Source) Since this project is Open Source, you don't have to take my word for it. You have full visibility:

   DIY Check: You can open the main.py file in this repository, copy the code, and paste it into an AI tool like Claude or Gemini (the free versions are sufficient and very good at this; I find them more detailed than the free version of ChatGPT for code analysis).

   Ask the AI: "Is this code malicious? What does it do?" You will see that the code is safe.

4. About the Windows Defender Error The specific alert Trojan:Win32/Etset!rfn is a generic heuristic detection.

   Translation: "Heuristic" means Windows Defender didn't find a real virus. Instead, its AI guessed that the file might be suspicious simply because it is a Python application packaged as an .exe (which obfuscates the code) and it doesn't see many users downloading it yet. It is a very common "guess" error by Windows Defender for independent software.

⚠️ Crucial Warning Please ensure you downloaded the application strictly from this GitHub repository. If you downloaded it from any other website, it might be a compromised version. In that case, check the Digital Signature immediately. If the signature is missing or invalid, delete the file and download it again from the official Releases page here.
https://github.com/Matteo842/SaveState/releases

I hope this clears up the confusion!

[tomrex4]

Got it, thanks for the detailed response!

[tharubberchicken]

I'm on Windows and the issue for me is that the name of the folder main.dll is created in changes periodically (upon app load?) I have whitelisted SaveState.exe and main.dll in Windows Defender as I do trust they are safe, yet once the temporary folder for main.dll changes Defender flags it again. Maybe if this folder name did not change then at least I will be sorted. 😁

[Matteo842]

@tharubberchicken 4f60565

[tharubberchicken]

@tharubberchicken 4f60565

Beautiful! 🙏🏻