Windows 10: my device detected trojan wacatac and I cant remove, locate or find it with anti viruses...

my device detected trojan wacatac and I cant remove either locate the file, I tried using Malwarebites, Kaspersky and other anti viruses but non of the seem to find anything, what should I do? Thank you guys.

:)

 

Trojan Script Wacatac H ml

Hi, I am making a backup of my iPhone 13 Pro Max via iTunes on a Windows computer, Windows 10.

When running Windows Defender anti-virus scan, it identifies Trojan Script Wacatac Hml as a virus in the iPhone backup folder in two files in folders 5f and b5. The file names are:

5f4af662a1def203d49f00e405c82342871d7dce and b5ca8fc6a4f9c4db7a19177237af546494d53a58.

All software on all devices is up to date.

Apple maintains it is a "false positive", iPhones cannot get viruses and Defender must fix their anti virus software. I have done everything to try and remove the trojan from the iPhone but to no avail. Please advise if it is in fact a "false positive".

Took forever to log this query: Error: Oops something went wrong.

Kind regards, Gert

 

Removing Wacatac trojan - Windows 10

Thank you, Jaspreet.

I have run Microsoft Safety Scanner, Malwarebytes and IOBit with the D: drive disconnected. All three say no threats detected.

Then i went back to running Windows Security (or Windows Defender or whatever it's called now in Windows 10). It still shows the wacatac trojan was detected on 4/15/2023. And running the "recommended actions" -- either quarantine or remove -- is not successful. So it seems that Windows Security just continues to show the previously detected threat, and it will never go away. Is there any way to clear that out of Windows Security?

 

Removing Wacatac trojan - Windows 10

Running Windows 10 on a Dell XPS8940 desktop with a 512GB SSD for the C: drive and a 1TB HDD for the D: drive.

On 4/15/2023, Windows Defender detected the Wacatac trojan. It reported a "severe" threat. I clicked on the box to perform the recommended actions, but Defender did not report that the item was removed or quarantined. I tried both.

I looked at the details of that Defender showed and deleted all of the affected files. They were all in an AppData directory that was not the current AppData; the directories were part of data I had copied onto the XPS8940 from my prior desktop. So I deleted all of the listed files. I believe I deleted all of the files listed by Defender, but guess it's always possible that there are other infected files.

Defender continued to report the wacatac trojan. Having read on here that this virus can add a lot of registry entries, etc. I did a system restore to the one available restore point from 4/13/2023. That was successful.

Then at some point, D: drive started behaving slowly. Windows Explorer ran very slow and when i tried to deleted some unnecessary folders, it was very slow. I could delete a single file successfully.

I ran malwarebytes and it reported no threats.

I ran iobit and it reported no threats.

The problems with the D: drive started affecting the boot process. I would just get the black screen with the large "Dell" logo and the spinning circle of white dots, that would go on for 15 minutes or more. Sometimes it would say "Press any key in the next 8 seconds to stop checking..." The first couple times i did that, it went to the sign-in screen and the PC seemed to be operating OK (it boots off the SSD). But it got to the point that it was nearly impossible to boot up.

So I opened up the PC and disconnected the cables to the D: drive. Then it booted up as normal (pretty fast). Then i ran:

- Windows Defender - still reports the wacatac trojan

- Malwarebytes - no threats reported

- Windows Safety Scanner - ran successfully and the log reports no threats.

QUESTION 1:

At this point, can I be confident the wacatac trojan is no longer a threat?

QUESTION 2:

How do I fix the D: drive? If I reconnect it, I suspect it is going to interfere with the boot process again. There is data on that HDD I don't want to lose. I was thinking perhaps i could remove it from the PC and put it in a housing with a USB connection. Then after boot-up, I could scan it with Windows Safety Scanner, Defender and Malwarebytes. Then try to run chkdsk? Or perhaps some drivers are damaged?

Should I consider installing a new HDD in the PC and just try to copy the data off the old one?

QUESTION 3:

Should i upgrade to Windows 11? Seems like i should sort out the D: drive issue first.

Thanks in advance for any wisdom you can provide.

Brian