Microsoft Defender detects Trojan script on update file of Massive X

Rok

Hello,

today I was updating some software. Also Massive X using Native Access. After the download the Windows Defender stopped the installation and reports:

Detected: Trojan:Script/Wacatac.H!ml

Massive_X_Installer.zip

Warning level: Serious*

*Translated

I just wanted to ask, does anybody else had this message? Is this a false alarm?

Thank you.

Greetings

Kubrak

It is because of MS virus scan, it detects some kind of trojan. Most probably there is no trojan, but better to wait....

I have the same problem on Win10. And many others as well.

Kymeia

What makes you think there is 'no response' from NI other than not bothering to look for them?

https://community.native-instruments.com/discussion/11699/known-issue-windows-defender-flagging-products-as-trojans/p1

HWZ

yes, the same

HWZ

...and also:

Rok

Ok so it is not only me.

Does anybody know if this is a false alarm?

Julesman

I see the same. Until I see a response from NI that addresses this issue I am not prepared to override Microsoft Defender.

remo

Hi there,

This could be a serious threat. NI does not seem to be the only one affected by this issue. Bluestacks was recently affected by this installation-issue as well. I suggest to wait with the update until NI makes an official statement that it's secure. And most importantly remember to backup your valuable data frequently!

However following information can be found in recent discussions:

On reddit it is mentioned that it could be a false positive, but still you should be cautious, better to wait until NI is responding or sending out a fixed update. There is also some frequent activity on the discussion, you can have a look here:

https://www.reddit.com/r/computerviruses/comments/x1af2y/any_chance_that_trojanscriptwacatachml_is_not/

Furthermore Bluestacks officially declared it as a false positive induced by a policy update on Microsofts side, they resolved it by updating their software once more:

https://www.reddit.com/r/BlueStacks/comments/11whnun/windows_defender_detects_wacatac_hml_while/

Also other services seem to have comparable issues the past few days:

https://github.com/microsoft/winget-pkgs/issues/100401

https://www.reddit.com/r/redgiant/comments/11y26nl/was_updating_trapcode_suite_and_windows_flagged_a/

For more information you can have a look here:

https://answers.microsoft.com/en-us/windows/forum/all/wacatac-trojan-horse-infection-or-false-positive/c561ee8e-1641-4cf1-9413-63bf62a87150

Rok

@remo thank you for the detailed explanation.

I also think the best is to wait for NI. It might be a false alert. But I'll take no risk and wait for NI.

Is NI monitoring this Forum or where do I have to report this?

aljas

Same issue with the Kontakt 7 Update through Native Access …

aljas

I just updated some software using Native Access. The update of Kontakt 7 failed, because Windows Defender detected a threat:

Detected: Trojan:Script/Wacatac.H!ml

Kontakt_7_Installer.zip

Warning level: Severe

There is a thread in the Massive X-section already about a similar issue: https://community.native-instruments.com/discussion/11586/microsoft-defender-detects-trojan-script-on-update-file-of-massive-x#latest

Maybe it is a false alert but I'll wait for a response from NI …

remo

@Rok I opened a support request ticket at NI, in case they are not already on to it, they will see it there.

alpha-w

same here,

got the same message on Massive X installer and Maschine 2 update

Viper

same issue here, hopefully NI responds soon.

Monochrome

I'd say that it's a false positive as well. In any case, NI is already aware of it:

https://community.native-instruments.com/discussion/comment/59185#Comment_59185

(From Guitar Rig 6.3 Update Virus)

chk071

Same issue with latest Massive X update.

Glad that it's being looked into. Sure it's a false positive.

voltizar

Receiving the same error message this morning.

LX.T

There is a new Defender Update, after that installation for Maschine worked without any issue.

For Massive X it is still there

PS: it looks like the alarm for Massive X was only the for the name of the zip-file.