Windows 10: Autorun.inf detected as virus by Microsoft Defender

Hi,I have create a custom autorun.inf which sets the icon and device label for the USB device.The contents of the autorun.inf are following[AutoRun] ICON = .\tS1_img.ico label=myDeviceIt is being detected as a virus with the following information : Name: Trojan:Script/Wacatac.H!ml ID: 2147814524 Severity: Severe

:)

 

How can I remove this virus remnant?

I was also going to suggest Autoruns.

Check to make sure it isn't attaching itself to explorer. It should be the 3rd thing listed in Autoruns, the listing for the Shell. It should just be Explorer.exe. If it is anything else, that might be your problem.

 

Virus Not Detected By Windows Defender

Hi,

If your running two antivirus at the same time and Windows Defender did not detect the virus, We suggest that you remove the virus with the third party malware that you're currently using. We recommend to use a single anti virus. and keep it up-to-date.

Let us know if you need further assistance.

 

Is it normal for some Microsoft entries to appear as not verified on autoruns?

Hi Sammy,

This seems to be a bug in Autoruns. Please check out the responses from "markc(msft)Microsoft" in the following link:

• Windows Defender executables: Publisher - (Not Verified) Microsoft Corporation
  

Quoting MarkC:

I traced this to an issue with the way that autoruns handles protected folders. For Microsoft published binaries we have an additional validation step that confirms whether or not the binary is in a protected system folder. For ProgramData this is not the case. The Windows Defender folder however IS locked down so I'm just waiting for confirmation from Mark R. that it's OK to add this and I'll get the fix updated.

Alternatively, you can run SigCheck.exe to know if the binaries are signed or not.

• Sigcheck - File version and signature viewer