What is Wacatac.B!ml Trojan? How to remove it from Windows?

Did Windows Defender warn you during a routine security scan that it detected a threat called Trojan:Script/Wacatac.B!Ml? Were you told that Windows Defender attempted to fix the threat but was unsuccessful and that further action was required?

If so, your computer is infected with the Wacatac Trojan that Windows Defender cannot automatically remove. In this article, Quantrimang.com will discuss in more detail about the Wacatac Trojan, how it infects your computer, and what you should do when this Trojan appears.

What is Wacatac.B!ml Trojan?

Wacatac.B!Ml is classified as a trojan by Windows Defender because it infiltrates the Windows operating system by tricking users into executing a file that appears to be legitimate.

The moment it infects your system, this trojan puts you at risk of identity theft, data infection, and financial loss. Furthermore, it consumes a lot of resources in the background without your knowledge, resulting in slow system performance.

Therefore, you should remove it immediately. Even Microsoft Defender warns you about the dangers of this trojan in the warning section and urges you to take immediate action. The question is, how did Wacatac.B!Ml appear on your computer?

How does Trojan Wacatac.B!Ml get into PC?

To understand how Wacatac Trojan gets into your PC, ask yourself the following questions:

1. Do you download cracked version of the program or use crack to activate premium software for free?
2. Have you downloaded an old version of any software or program from a suspicious website?
3. In the last few days, have you received an email that seemed authentic (maybe a shipping invoice you don't remember creating), but when you clicked on the attachment in the email, it ran a script and suddenly disappeared?
4. Do you download a movie or song using a torrent file to avoid paying?
5. Did you turn off Windows Defender or your antivirus program for a few days, then rescan your computer and find this threat?

If you answered yes to any of the above questions, you have found how the Wacatac Trojan got onto your computer. But could it be a false alarm? It is possible, so you should rule this out first.

Make sure the Wacatac.B!Ml trojan warning is accurate

Did you detect a trojan infection after running a random security scan? You should make sure that the Wacatac Trojan warning is correct. Follow the steps below:

1. Go to the VirusTotal website . Click the Choose file button on the VirusTotal website.

2. Navigate to the path of the affected item where Windows Defender detected the trojan. In most cases, the path will be as follows:

C:\WINDOWS\System32\config
ystemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\QINNLJOV.htm

3. Select the infected file and upload it.

If the scan reports nothing, it may be a false positive. However, whether the file is clean or the scan detects a trojan or malware, it's best to scan and remove it.

How to remove Wacatac.B!Ml trojan from your device

If you are sure that the Wacatac threat is not a false alarm and just want to make sure that your device is not infected or the scan shows that the file you scanned is infected, you should do the following steps:

1. Delete infected files

The first step is to delete the infected file that Windows Defender claims is infected. So navigate to the same path mentioned above, right-click on the file and select Delete.

After deleting the file, run a security check on your computer again. If the trojan still appears on your system, move on to the next fix.

If the file that Windows Defender detects as a threat is a Windows operating system file, you should be cautious before deleting it. Otherwise, it could make your computer unbootable.

2. Manually remove the threat

Windows Security makes it easier to remove threats manually. Here are the steps to follow:

• Press Win + I to open the Settings app .
• In the left sidebar, click Privacy & security .
• In the right pane, click Windows Security.

• Click Virus & threat protection .
• Then click Protection history.

• Click on the Wacatac threat .
• Open the Actions drop-down menu and select Remove.

Rerun the scan. If the threat is not removed, follow the same steps and select Quarantine from the Actions drop-down menu. This will prevent the virus from spreading further. Move on to the next step.

3. Run a malware scan in Safe Mode

Usually, the presence of malware will prevent Windows Defender from deleting infected files. To prevent this from happening, you should first boot your device into Safe Mode . That way, the malware won't interfere with deleting infected files.

Next, you should run a full Windows Defender scan. Keep in mind that a full virus scan can take over an hour, so be patient and let it complete. Once the scan is complete, check to see if Windows Defender is still reporting threats. If so, run a malware scan with a third-party antivirus program.

Sometimes Windows Defender fails to completely remove malware or continues to give false warnings despite removing the virus. Third-party software can help you determine if the threat is present and remove it if it is. If that fails, reset your computer.

4. Reset the operating system

If none of the fixes work, you can reset Windows as a last resort. During the reset, Windows will remove all installed apps and restore all customizations to their defaults, but your files will remain intact (if you choose to do so). Quantrimang.com has a guide on how to factory reset your Windows device if you’re not sure how to do it.

Does the Wacatac trojan warning appear when you download a file?

Do you see a Wacatac Trojan warning when downloading a specific file from the Internet? If so, temporarily disconnect your device from the Internet. Disconnecting your PC from the Internet will prevent the Trojan from infecting your system if it tries to do so.

Then, scan your computer for malware using Windows Defender to see if it detects the trojan. If it doesn't show any trojans but then shows a warning when you download the file, confirm that it's not a false alarm.

There have been reports of Wacatac Trojan warnings sometimes appearing when downloading archives, especially with the .RAR extension, even from legitimate sources. If that is the case for you, follow the steps below:

• Copy the download link of the file you want to download.
• Go to the VirusTotal website.
• Enter the URL into the URL scanner.
• Press Enter.

If VirusTotal comes back clean, you can download the file without worrying. Just add a whitelist to Windows Defender to exclude the file and you're good to go. If the tool detects malware, it's best not to download it.

Now that you have a better understanding of the Wacatac Trojan, if your device is infected, removing it will be easier now. Also, use a third-party antivirus software along with Windows Defender to further secure your system.