Hello,
The package tis-Notepadpluplus_8.9.6.4-12_x64 downloaded this morning from your repository has been flagged by Windows Defender as a Trojan (Trojan:script/Wacatac.C!ml) and quarantined.
Thank you for your help.
- Installed WAPT version (2.6.1.17765)
- Server OS (Linux and version (Debian 13))
- Administration/package creation machine OS (Windows Server 2019)
[SOLVED] Notepad++ package seen as a trojan
Forum Rules
Community Forum Rules
* English support on www.reddit.com/r/wapt
* French community support is available on this forum
* Please prefix the topic title with [RESOLVED] if it is resolved.
* Please do not edit a topic that is tagged [RESOLVED]. Open a new topic referencing the old one.
* Specify the installed WAPT version, full version, and build number (2.2.1.11957 / 2.2.2.12337 / etc.) as well as the Enterprise/Discovery edition.
* Versions 1.8.2 and earlier are no longer supported. The only questions accepted regarding version 1.8.2 are related to upgrading to a supported version (2.1, 2.2, etc.).
* Specify the server OS (Linux/Windows) and version (Debian Buster/Bullseye - CentOS 7 - Windows Server 2012/2016/2019).
* Specify the OS of the administration/package creation machine and the machine with the problematic agent, if applicable (Windows 7/10/11/Debian 11/etc.).
* Avoid asking multiple questions when opening a topic, otherwise it may be ignored. If there are multiple topics, open separate topics, preferably one after the other and not all at the same time (i.e., do not spam the forum).
* Include code snippets, screenshots, and other images directly in the post. Links to Pastebin, Bitly, and other third-party sites will be systematically removed.
* As with any community forum, support is provided voluntarily by members. If you require commercial support, you can contact Tranquil IT's sales department at 02.40.97.57.55
Community Forum Rules
* English support on www.reddit.com/r/wapt
* French community support is available on this forum
* Please prefix the topic title with [RESOLVED] if it is resolved.
* Please do not edit a topic that is tagged [RESOLVED]. Open a new topic referencing the old one.
* Specify the installed WAPT version, full version, and build number (2.2.1.11957 / 2.2.2.12337 / etc.) as well as the Enterprise/Discovery edition.
* Versions 1.8.2 and earlier are no longer supported. The only questions accepted regarding version 1.8.2 are related to upgrading to a supported version (2.1, 2.2, etc.).
* Specify the server OS (Linux/Windows) and version (Debian Buster/Bullseye - CentOS 7 - Windows Server 2012/2016/2019).
* Specify the OS of the administration/package creation machine and the machine with the problematic agent, if applicable (Windows 7/10/11/Debian 11/etc.).
* Avoid asking multiple questions when opening a topic, otherwise it may be ignored. If there are multiple topics, open separate topics, preferably one after the other and not all at the same time (i.e., do not spam the forum).
* Include code snippets, screenshots, and other images directly in the post. Links to Pastebin, Bitly, and other third-party sites will be systematically removed.
* As with any community forum, support is provided voluntarily by members. If you require commercial support, you can contact Tranquil IT's sales department at 02.40.97.57.55
-
dcardon
- WAPT Expert
- Messages: 1978
- Registration: June 18, 2014 - 09:58
- Location: Saint Sébastien sur Loire
- Contact :
Hi Sylvie,
yes, there's a VirusTotal alert for the Notepad++ package [1] just for Microsoft; all the others are OK.
One of WAPT's security features is that the package is a signed zip file whose contents you can verify. So you can audit the setup.py file and check the hashes of the included executables, here npp.8.9.6.4.Installer.x64.exe [2], where VirusTotal is completely OK, even Microsoft Defender, which is unhappy if we put this same file in a zip file.
So if you have alerts with your antivirus/EDR, you should refer to VirusTotal to see if it's a false positive. If you're a Microsoft Defender paying customer, you can resubmit the file for them to perform another analysis.
Regards,
Denis
[1] https://www.virustotal.com/gui/file/f40 ... 08c231f628
[2] https://www.virustotal.com/gui/file/cb9 ... 288e4ed2ea
yes, there's a VirusTotal alert for the Notepad++ package [1] just for Microsoft; all the others are OK.
One of WAPT's security features is that the package is a signed zip file whose contents you can verify. So you can audit the setup.py file and check the hashes of the included executables, here npp.8.9.6.4.Installer.x64.exe [2], where VirusTotal is completely OK, even Microsoft Defender, which is unhappy if we put this same file in a zip file.
So if you have alerts with your antivirus/EDR, you should refer to VirusTotal to see if it's a false positive. If you're a Microsoft Defender paying customer, you can resubmit the file for them to perform another analysis.
Regards,
Denis
[1] https://www.virustotal.com/gui/file/f40 ... 08c231f628
[2] https://www.virustotal.com/gui/file/cb9 ... 288e4ed2ea
Denis Cardon - Tranquil IT
Share your experiences on WAPT! Send us your blog and article URLs in the "Your Opinion of the forum, and we'll feature them on the WAPT
Share your experiences on WAPT! Send us your blog and article URLs in the "Your Opinion of the forum, and we'll feature them on the WAPT
-
dcardon
- WAPT Expert
- Messages: 1978
- Registration: June 18, 2014 - 09:58
- Location: Saint Sébastien sur Loire
- Contact :
Hi Sylvie,
it seems Microsoft has changed its mind and everything is green now:
https://www.virustotal.com/gui/file/f40 ... ?nocache=1
Has it worked for you too?
Regards,
Denis
it seems Microsoft has changed its mind and everything is green now:
https://www.virustotal.com/gui/file/f40 ... ?nocache=1
Has it worked for you too?
Regards,
Denis
Denis Cardon - Tranquil IT
Share your experiences on WAPT! Send us your blog and article URLs in the "Your Opinion of the forum, and we'll feature them on the WAPT
Share your experiences on WAPT! Send us your blog and article URLs in the "Your Opinion of the forum, and we'll feature them on the WAPT
