inno-setupwindows-defendertrojan

Program installed with Inno Setup seen as Trojan (Wacatac.B!ml)


My software is a .NET application. The original .exe compiled with Visual Studio works fine and Microsoft Defender has nothing to say about it or any of the dependencies.

I made an installer with Inno Setup, that has been working fine until now, on a bunch of different machines.

The installer deploys my two .exe (the main app and an admin tool) and my own libraries, a few other libraries (Helix Toolkit, Triangles.net), and some libraries from .NET 5.0 (so that the framework is not needed for an offline install).

Since this morning, I have the following:

To be clear:

Is it possible that Inno Setup put that Trojan in my exe? If so, what could I do to prevent or circumvent it?

The more I investigate this, the less I understand what Inno Setup does. My original exe file weighs only 280 Ko, and the exe file installed by Inno Setup weighs 132 Mo. And, again, the Trojan is ONLY detected in the exe installed by inno setup.

Screen cap (sorry for the french OS):

enter image description here

The trojan description is:
https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3aScript%2fWacatac.B!ml&threatid=2147735503

The Inno Setup installer is now seen as containing the trojan and put in quarantine.

enter image description here


Solution

  • This is a false positive alarm.

    Report your software as safe to several AV companies and wait till the update their databases.

    Also it helps if the software is signed with certificate, has many users/downloads and everyone reports it as safe.