Trojan:Win32/Wacatac.B!ml — How to Stop False Positives in Defender

Quick answer

If you're 100% certain the file is legit, open Windows Security → Virus & threat protection → Manage settings → Exclusions, add the file or folder, then restore it from quarantine. If you're not certain, don't exclude it — the detection is probably real.

What's actually happening here

Wacatac isn't a single piece of malware. It's a heuristic family label Defender slaps on anything that smells like a dropper — code that unpacks something else at runtime. The !ml suffix tells you the verdict came from a machine learning model, not a signature match. That's your first clue. Signature hits usually mean someone has already seen that exact binary. ML hits mean Defender looked at behavior patterns and guessed.

The guess is right most of the time. But it's wrong often enough to be annoying. I've seen Wacatac fire on:

• Unsigned game trainers and mod loaders that unpack assets at runtime
• NSIS and Inno Setup installers built without a code-signing certificate
• Custom .NET utilities built with obfuscators like ConfuserEx
• PowerShell scripts that download a payload and execute it in memory (legit admin tools do this too)
• Python scripts frozen into .exe with PyInstaller

The reason step 3 works is that exclusions bypass the scanning engine entirely. Defender never evaluates the file against the ML model, so it never gets a chance to guess wrong. That's also why exclusions are dangerous if you're wrong about the file.

Before you exclude anything

Do this or you'll spend a week cleaning up a real infection. Check three things:

1. Where did the file come from? If it's from a torrent, a Discord DM, or a "crack" site, stop. Exclude nothing.
2. Upload the file to VirusTotal. If 5+ engines flag it, it's malware. If it's just Defender and one obscure engine, you're probably fine.
3. Check the digital signature. Right-click the file → Properties → Digital Signatures. A valid signature from a known vendor is strong evidence.

Step-by-step: exclude and restore

Step 1 — Open the threat history

1. Press Win + I, go to Privacy & security → Windows Security.
2. Click Virus & threat protection.
3. Under Current threats, click Protection history.

You'll see every Wacatac hit with the exact file path. Write those paths down — you need them for the exclusion.

Step 2 — Add the exclusion

1. Back on Virus & threat protection, click Manage settings under Virus & threat protection settings.
2. Scroll to Exclusions and click Add or remove exclusions.
3. Click Add an exclusion and pick File if it's one binary, or Folder if the whole directory keeps getting flagged.
4. Select the exact path from step 1.
5. Confirm the UAC prompt. You'll need admin rights.

Exclude the folder, not the whole drive. Excluding C:\ or an entire user profile is a great way to let real malware sit there undisturbed for months.

Step 3 — Restore the file from quarantine

1. Go back to Protection history.
2. Find the Wacatac entry.
3. Click the dropdown arrow, then click Actions → Restore.
4. If Restore is greyed out, the file was fully deleted. Reinstall or re-download it — the exclusion will now prevent it from being flagged.

Step 4 — Run a quick scan to confirm

Start-MpScan -ScanType QuickScan

Run this in an elevated PowerShell window. If Wacatac comes back, your exclusion path was wrong — probably a case mismatch or a stale path that Windows has since virtualized (the _MEI folders PyInstaller creates on every launch are the usual culprit).

For PyInstaller specifically, you need to exclude the extracted temp folder, not the original exe:

%TEMP%\_MEI*

Wildcards aren't supported in the GUI. Add the parent %TEMP% folder via PowerShell instead:

Add-MpPreference -ExclusionPath "$env:TEMP"

If exclusions don't stick

Sometimes Defender ignores new exclusions. Usually that's because Tamper Protection is on and something else is managing Defender — a third-party AV that hasn't fully uninstalled, or a Group Policy object from a domain you used to be joined to.

• Check for orphaned AV installs with Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct. If McAfee or Norton shows up but isn't installed, run their removal tool.
• Check Local Group Policy: gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Exclusions. Anything here overrides the GUI.
• As a nuclear option, disable the real-time protection temporarily from the same settings screen — but only for a few minutes while you sort out the exclusion. Leaving it off is how people get actual Wacatac infections.

Stop this from happening again

Sign your binaries. If you're a developer shipping a Windows tool, an EV code-signing cert (around $300/year) is the single best thing you can do to stop ML false positives. Defender's ML model heavily weights signature presence. Unsigned + packed = flagged, every time. Signed + packed = usually fine.

If you're the end user, the second-best move is submitting the false positive to Microsoft via the file submission portal. Turnaround is usually 24-72 hours, and once they whitelist the hash, everyone running that same binary stops getting flagged. It's tedious, but it fixes the problem at the source instead of papering over it on your machine.