Search Unity

  1. Megacity Metro Demo now available. Download now.
    Dismiss Notice
  2. Unity support for visionOS is now available. Learn more in our blog post.
    Dismiss Notice

Trojan:Script/Wacatac.B!ml in build

Discussion in 'Editor & General Support' started by ScottyDSB, Feb 14, 2021.

  1. ScottyDSB

    ScottyDSB

    Joined:
    Mar 18, 2016
    Posts:
    124
    Hi.

    I'm generating a build for my game. Before today I had no problems. With Unity 2020.2.4 I'm getting:

    Trojan:Script/Wacatac.B!ml detected (Windows 10, the internal antivirus).

    I'm looking for solutions to the problem, I'll let you know if I find any.
     
    russisunni and stream_in_space_ like this.
  2. hippocoder

    hippocoder

    Digital Ape

    Joined:
    Apr 11, 2010
    Posts:
    29,723
    That'll most certainly be a false positive.

    I run up to date legit Windows 10 and use the built in Windows Defender. My version is Unity 2020.2.4f1 (64-bit)

    And there are no trojan notifications.


    If you are getting this, perhaps list the packages or addons you use?
     
  3. ScottyDSB

    ScottyDSB

    Joined:
    Mar 18, 2016
    Posts:
    124
    I didn't add any new packages or assets, in fact this is a game that is being ported from iOS to Windows, deleting the iOS features and adding Steam features (steamboards etc). I'll try to see if there is something about this, thank you.
     
  4. hippocoder

    hippocoder

    Digital Ape

    Joined:
    Apr 11, 2010
    Posts:
    29,723
    I think it's just false positive. To clarify, do you only get this during a build?
     
  5. Mauri

    Mauri

    Joined:
    Dec 9, 2010
    Posts:
    2,663
  6. ScottyDSB

    ScottyDSB

    Joined:
    Mar 18, 2016
    Posts:
    124
    Yes, only the build is detected as a trojan.
     
  7. ScottyDSB

    ScottyDSB

    Joined:
    Mar 18, 2016
    Posts:
    124
  8. ScottyDSB

    ScottyDSB

    Joined:
    Mar 18, 2016
    Posts:
    124
    I have uploaded the build to VirusTotal.com and no trojans detected anywhere. So the build is ok, I have added an exception to the Windows security antivirus. Thank you.
     
  9. ScottyDSB

    ScottyDSB

    Joined:
    Mar 18, 2016
    Posts:
    124
    Update: I downloaded the new version of Windows Defender file and now it is ok, the exe is not being considered a trojan.
     
  10. Lynxed

    Lynxed

    Joined:
    Dec 9, 2012
    Posts:
    121
    Getting this right now with 2020.3.9f1 on windows 19
     
  11. Goty-Metal

    Goty-Metal

    Joined:
    Apr 4, 2020
    Posts:
    168
    Having the same issue SINCE 2020.3.9f1, i have 2020.3.10f1 and has the same problem.
    (Windows 10 legit full updated)
     
  12. stream_in_space_

    stream_in_space_

    Joined:
    Dec 22, 2015
    Posts:
    13
    Same crap. I think it began after today's update Virus' & threat protection. The day before all builds were successful.
    Bill, fix it pls, or Unity can produce an apk affected by trojan viruses :eek: ?
     
    Last edited: Jul 15, 2022
  13. russisunni

    russisunni

    Joined:
    Oct 26, 2019
    Posts:
    8
    I had the same thing, though I did have a certain multiplayer plugin added. What I did was to install the latest version of Unity. When I imported the game into that, and built it, no more problems. Not sure if it was the new version or recreating the library that did it.
     
    nabI38 likes this.
  14. rh73

    rh73

    Joined:
    Feb 3, 2017
    Posts:
    8
    I've just experienced the same problem, Windows Defender claims it found Trojan:Script/Wacatac.B!ml in a RAR archive I created from a fresh build created with Unity Editor 2022.2.11f1. The build itself has no issues, the warning pops up as soon as I create an archive from it.

    Legit Windows 10, WinRAR downloaded from their official website (free version for personal use), I did not install any special packages in Unity, it's a prototype built from the "empty 3d project" template with just a few C# scripts and 1 texture file I created myself.

    Even if this is a false positive (neither Windows Defender nor Malwarebytes find anything suspicious on my hdds when running a full scan), it's very annoying because like that I don't feel like I can safely send the archive to my frineds for testing. I'd really like to know if this is a Unity problem, or a WinRAR problem, or a hiccup in Windows Defender's detection heuristics.
     
  15. dvpitcher

    dvpitcher

    Joined:
    Nov 1, 2021
    Posts:
    1
    I'm also experiencing this issue, fresh build from 2020.3.37f1 packed into a RAR and it is flagged right away by Windows Defender. I ran Malwarebytes as well, no concerns found. I've reproduced it nearly a dozen times now

    edit: from YourGameNameHere_Data, if I navigate to the Managed folder, and delete "UnityEngine.WindModule.dll" then windows defender takes no further issue with the RAR
     
    Last edited: Mar 23, 2023
    nabI38 likes this.
  16. feryaz

    feryaz

    Joined:
    Sep 5, 2014
    Posts:
    11
    Multiple of my players have this problem with my game downloading it through steam. All at roughly the same time without any changes on the game. Using 2021.3.27f1

    Any things I can try?
     
  17. feryaz

    feryaz

    Joined:
    Sep 5, 2014
    Posts:
    11
    Oh its

    Trojan:Script/Sabsik.FL.B!ml

    for me.
     
  18. Eternit_EGIK

    Eternit_EGIK

    Joined:
    Aug 14, 2018
    Posts:
    1
    Faced with this Trojan problem
    I made a project with version 2021.3.26f1 lts, after the build, I threw the exe file to the virustotal website
    The site showed the presence of the Trojan Sabsik.FL.B!ml

    Deleted all versions of unity

    Installed the latest version at the moment 2022.3.2f1 lts
    Copied the project to a separate folder and compiled the project in 2022.3.2f1 lts for architecture 64
    I threw the exe file of the build to the virustotal site - The site showed the presence of Trojan.Psw.jmeter
    Without changing anything in the project, I compiled the project in 2022.3.2f1 lts for architecture 32! to another folder
    I threw the exe file of the build to the virustotal site - the site showed the presence of a Trojan.Malware.300983.sysgen and W32.AIDetectMalware

    Am I generating Trojans? )

    For the sake of experiment, I removed the assembly on the 64 architecture and compiled it again for the 64 architecture
    I threw the exe file of the build to the virustotal site - The site showed the presence of Trojan.Psw.jmeter !!!

    I 'm in shock )
     
  19. feryaz

    feryaz

    Joined:
    Sep 5, 2014
    Posts:
    11