CKAN Flagged as a virus and unable to be opened.

[Geostationary Syncom]

I am terribly sorry if this is the wrong place to put this, but I need help. Today I booted up CKAN and it told me an update was available. So naturally I told it to download the update. It immediately closed and windows antivirus started losing its mind, flagging it as a deadly Trojan and deleting it. I have redownloaded CKAN four times and evey time I am unable to open it, its flagged as a virus, and then deletes itself. What is going on. Help?

[Geostationary Syncom]

If it helps, Windows says it detected this in ckan.exe:

Trojan:Script/Wacatac.B!ml

[DeadJohn]

Tagging @HebaruSan. Hopefully Windows is giving a false virus alert, but maybe today's CKAN release v1.34.4 was compiled on a compromised PC.

[HebaruSan]

2 minutes ago, DeadJohn said:

maybe today's CKAN release v1.34.4 was compiled on a compromised PC.

No, CKAN releases are never compiled on a PC. An automated process builds them in a fresh Docker image.

I've filed a request with Microsoft to get their busted scanner fixed. In the meantime you can tell Windows to allow this file, but the UI for that is about as terrible as the scanner that's raising this false positive, so you should go to Microsoft for help with it as their paying customer.

[Kerbart]

From the Microsoft site:

Quote

 

Wacatac.B!ml really is malware, but Defender detects and remediates it. See the link...

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Wacatac.B!ml&ThreatID=2147774417

Defender has already protected you from this. However, if you continue to be alerted to its presence, that would be a false positive. You can prove that, by downloading the Microsoft Safety Scanner, and scan your PC with that. If it does not detect Wacatac, you can be sure, that you are seeing a false positive.

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

You can eliminate that false positive, by deleting Wacatac from Defender's Protection History. The following explains how to accomplish that in W10. I suspect that this applies to W11 also.

• Open File Explorer, and on the View Tab, check the box for "Hidden Items".
• Then navigate through this path.
• C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service
• Open the Service folder. If you find a folder in it, named Detection History, then W11 is the same
• as W10 in this regard. Delete Detection History, and the false notification regarding Wacatac will cease.

Not to worry, Windows rebuilds Detection History when it is needed next.

 

 

[HebaruSan]

So far Microsoft's online scanner seems a little smarter than the one they put on everyone's PC.
(If you ignore the fact that this gigantic table can't be shrunken down to be more readable, and that instead of an overall summary line, we have to read "No malware detected" 28 times.)