Trojan:Win32/Wacatac.B!ml is a Microsoft Defender detection name. Keep the affected item quarantined while you check its source and whether it ran. The related Trojan:Script/Wacatac.B!ml alert needs the same evidence check. A false positive is possible, but a file that was blocked before execution can still be malicious. If the warning returns or says Remediation incomplete, open Protection history and record the newest detection time, status, and full affected-item path. An old resolved card, a remaining ZIP, and a newly detected file require different next steps.
Choose the next step for your Wacatac.B!ml alert
- Blocked download you did not run: keep it out of use. Remove the identified untrusted package, or request review of the exact file if it came from an expected official release.
- Action needed or Remediation incomplete: expand the card, follow the outstanding action, then use the full-scan cleanup steps.
- Warning appears again: compare the event and object using the repeat-alert decision list before deleting anything else.
- You ran the suspicious file or see account misuse: address device cleanup and account exposure together. Use a separate trusted device for account recovery.
Do not restore the file, disable protection, or add an exclusion just to finish an installation.
If the same incident also created encrypted files with the .kora extension and a HOW_TO_DECRYPT.txt note, treat it as a ransomware recovery case and follow the Kora ransomware cleanup and restore guide before reconnecting backups.
What Does Trojan:Win32/Wacatac.B!ml Mean?
In Microsoft’s naming scheme, Trojan is the threat type, Win32 is the platform, Wacatac is the family name, and B is a variant letter. A suffix beginning with ! is an internal Microsoft indicator. The public naming guide does not define a file-specific verdict or exact detection algorithm for !ml. [5]
Microsoft’s Win32/B description discusses malicious activity that can steal information, download other malware, or enable further compromise. Those capabilities explain the potential risk; the alert name alone cannot tell you what your particular file did. [1]
This guide covers both Win32/Wacatac.B!ml and Script/Wacatac.B!ml. For another variant, use the Wacatac.H!ml guide; for the broader label, see Trojan:Win32/Wacatac. Trojan:Script/Conteban.A!ml is a separate detection. The Defender detection names guide explains the other name components.
Win32 vs Trojan:Script/Wacatac.B!ml
Preserve the exact label in your report, but inspect the affected object too. A Script label does not establish that the visible file is a JavaScript file, and neither label tells you whether it executed. An archive can contain an executable or script; the container and its contents are different objects.
For a concrete example, developer Dylan Beattie reported in December 2024 that a ZIP containing his .NET 9 AOT-compiled Windows binary triggered Trojan:Script/Wacatac.B!ml. His post includes build settings and a Defender screenshot. This is a historical report about a specific build scenario, not a test we repeated or a clearance for today’s .NET applications. It shows why a useful report includes the build version and archive/member details instead of relying on the word “Script.” [6]
Is Wacatac.B!ml malware or a false positive?
Separate two questions: is this file malicious? and did it have a chance to run? A malicious installer blocked during download is still malicious, even if it never infected the PC. Conversely, an alert on your own build needs investigation even though you recognize the project.
- Untrusted source or unexpected behavior: a crack, fake update, unknown attachment, or unexplained security changes justify keeping the item blocked and cleaning the device. Do not use a familiar filename as reassurance.
- Expected vendor release or your own build: compare the exact release, source, signature and available hash, then seek file-specific review. Being signed, unsigned, packed, or inside a ZIP is context rather than a verdict.
- One scanner flags it; others do not: the disagreement is a reason to investigate the same file and scan date. Neither a low detection count nor a clean system scan establishes that a quarantined file is safe to restore.
%TEMP%, AppData, browser cache and Downloads all contain legitimate files too. Use the full affected path to identify the object and its source, not to label the whole folder dangerous.
If Defender Found Wacatac.B!ml in a ZIP, RAR, Browser Cache, or Partial Download
A Wacatac.B!ml alert may identify a compressed file, an interrupted browser download, a mod archive, or cached content. That does not automatically prove the code ran. It means Defender saw suspicious content while scanning the container, the extracted item, or the download stream.
- ZIP/RAR/7z: remove only the identified untrusted archive or package. For your own or a trusted archive, keep it unused and request vendor review. Do not restore a quarantined member or extract the archive again just to test it.
- Browser cache or partial download: remove the identified source download; use the browser’s settings to clear cached content when the affected object is in its cache. Do not delete the whole Downloads folder or browser profile. A blocked download alone does not show that code ran.
- Game mods, emulators, APKs, and developer builds: record the exact release and source, then follow the file-review steps below. If the alert concerns WiiUDownloader, use our WiiUDownloader Wacatac.B!ml guide.
- Only one scanner detected it once: keep the file out of use, update definitions, and seek Microsoft or vendor review. Rescan only an already available non-quarantined copy without opening it; do not restore it for testing.
What to Do First
- Keep the item quarantined. Open Windows Security > Virus & threat protection > Protection history. Save the newest event time, status, and every affected path or archive member before cleanup; administrator access may be needed to see the details; see Microsoft’s Protection history guidance [4].
- Record what happened: where the package came from, whether you opened or extracted it, and whether the alert names a remaining source container. The path helps locate evidence; it does not prove execution or theft.
- Protect accounts immediately when exposure is plausible. If a suspicious program is running or you see ongoing compromise, disconnect the affected PC from networks and use a trusted device to get help. If you ran the suspicious file, entered credentials on a fake page, or see account misuse, use a separate trusted device to change exposed passwords and revoke affected sessions while local cleanup proceeds. Do not enter replacement passwords on the suspect PC. Notify IT/security and preserve evidence first on a managed device.
- Run the full cleanup below. Update security intelligence and use the Gridinsoft installation, Full Scan, cleanup, and restart checks. A blocked single download without execution or account misuse does not automatically require password resets.
How to Remove Trojan:Win32/Wacatac.B!ml
1. Keep the Alert Contained and Identify the Source
Leave the item quarantined or choose the recommended removal action in Protection history. Remove the specific untrusted ZIP/RAR/7z, ISO, installer, or partial download named by the evidence. Do not restore it, re-extract it, or erase unrelated files. On a work PC, let IT preserve and handle the evidence.
2. Install, Update, and Run a Full Scan
A quarantined archive member may be only one part of a downloaded bundle. Download and install Gridinsoft Anti-Malware from its official site, update its detection database, and choose Full Scan to check the rest of the system for related components. If the PC is isolated because compromise is ongoing, obtain the official installer using a trusted device and ask IT/support about an offline cleanup route; do not reconnect just to browse for tools. A loader, bundled app, or startup task may remain if the package ran; quarantining one file does not check every component.
3. Review Results, Apply Cleanup, and Verify
Review the detected items and their paths, apply the recommended quarantine or removal, and restart if requested. Run an updated scan and compare the newest event time, status, and object with your saved details. Do not treat an unchanged old card as a fresh detection. Clean results cannot prove that no data was stolen before cleanup; continue any needed account recovery on a trusted device.
4. Investigate Continuing Activity Only When Needed
If a fresh unresolved detection or unexplained file recreation continues, inspect the related Startup app, scheduled task, service, or browser extension using its full command and target path. The names powershell.exe, wscript.exe, and cscript.exe also belong to legitimate Windows tools; do not delete them or an unfamiliar entry solely because of its name or location. Preserve unclear evidence for IT or support.
If the returning symptom is a CircuitryAg.exe error after a ZIP download, use the CircuitryAg.exe startup and missing-DLL checks to distinguish a failed launch from a recreated file or startup entry.
Microsoft Defender Offline is an optional follow-up for persistent detections or failed cleaning: save your work and select it under Windows Security > Virus & threat protection > Scan options. It restarts Windows; it is not a prerequisite for the full scan above. Keep your BitLocker recovery key accessible if device encryption is enabled. See Microsoft’s scan-options guidance [2].
“Remediation incomplete” or Wacatac.B!ml keeps coming back
Remediation incomplete means Defender attempted cleanup but did not finish. Expand that card for the outstanding action. A quarantined item is contained; a blocked item has been removed by Defender. These statuses describe that item, not everything that may have happened before it was detected. [4]
After the cleanup above, compare your saved details with what Windows Security now shows:
- Same old time, resolved status, no new detection: this is a historical record, not evidence that the file returned. Leave the evidence intact; deleting Protection history does not remove malware.
- Same old time, but action still needed or incomplete: do not dismiss it as stale. Follow the card’s action, check whether the named source container remains, and seek support if remediation still fails.
- New time, same ZIP/RAR or partial download: the source package may still be present. Quarantining an extracted member is different from removing the original archive. Remove only an identified untrusted package; keep a trusted one unused pending review.
- New time after a download, extraction, app update or browser visit: record that trigger and the new object. Stop repeating the download or launch. For a confirmed browser-cache object, close the offending page and clear cached content through browser settings; do not erase your entire profile.
- New detection after restart without those activities: investigate whether the affected object actually exists or is being recreated. Use the targeted Startup/task/service checks above or give your saved evidence to IT/support. A changed path alone cannot identify the process responsible.
Example: one archive, two affected objects
Suppose a report names %USERPROFILE%\Downloads\package.zip and the member setup.exe, then a later alert names %TEMP%\setup.exe after you extract the package again. This illustrative sequence is consistent with another extraction; it does not by itself establish a hidden startup infection. Stop using the source archive and complete cleanup. If a fresh alert appears after restart without another extraction or download, save that new event for targeted investigation.
The filename in this example is not an indicator of compromise. Compare the full object, event time and trigger. If other effects remain, follow the Windows security audit after malware.
How to Handle a Likely False Positive
Keep the item unused while gathering a review packet. “It was in a ZIP” or “I never opened it” answers neither whether the contents are malicious nor whether this exact detection is wrong.
- Identify the exact object. Save the full detection, time, status, path, archive member, application version and actual download source. For your own software, include the build configuration and dependencies.
- Compare with the publisher’s release. Check any published hash and digital-signature details for that same version. A matching hash identifies the same bytes; a valid signature identifies the signer and signed-file integrity. Neither alone certifies harmless behavior.
- Update protection. Rescan only an already available non-quarantined copy without opening it. Do not restore or re-extract a blocked item to calculate a hash or test whether another scanner agrees.
- Request a file-specific verdict. Use the Microsoft file submission process [3] or ask the publisher to submit the affected release. For private/work files, use IT’s approved process before uploading; do not publish samples or full personal paths in a forum. If the only copy is quarantined, ask the vendor or IT to handle sample collection.
- Prefer a corrected release or detection update. Consider restoration only when Microsoft/vendor review addresses that exact file and supports the false-positive conclusion. Keep the block if uncertainty remains. Do not allow an entire folder, profile, drive or file type.
For most home users, deleting the suspicious file is safer than excluding it. Exclusions tell Defender not to inspect that location, which can make a real infection easier to miss later.
How to Avoid Wacatac-Style Alerts Again
- Do not run cracks, keygens, pirated installers, or “activation” tools.
- Keep file extensions visible in Windows so
invoice.pdf.jsdoes not look like a PDF. - Do not open scripts from email, chat, or shared folders unless you expected them.
- Keep Defender real-time protection and cloud-delivered protection enabled.
- Use standard user accounts for daily work instead of an administrator account.
- Back up important files to a location malware cannot easily rewrite.
FAQ
Does !ml mean Wacatac.B!ml is probably a false positive?
No. An ending in a detection name is not a probability or a verdict on your file. Microsoft’s public naming guide describes exclamation-mark suffixes as internal indicators. Verify the exact object and source; there is no defensible universal false-positive percentage for every file carrying this name.
Why did Defender flag a ZIP if I never ran the program?
Scanning can detect suspicious contents before you execute them. That distinction matters for exposure, but it does not make the file harmless. Keep the affected item blocked, identify the original archive, and do not extract it again to test it.
What if only Microsoft detected it in VirusTotal?
Scanner disagreement is not a clearance. Check that the report refers to the same file and a relevant scan date, and obtain Microsoft/vendor review before restoration. Do not upload private files to a public scanning service or restore quarantine to obtain another result.
Should I delete Defender’s history when Remove does nothing?
No. Save the event first and distinguish an old resolved card from an unresolved or fresh detection. An incomplete action needs follow-up; removing its record only hides the evidence. Use the status and source-container checks above, then contact support if cleanup still fails.
Do I need to reinstall Windows?
A single blocked download does not automatically call for reinstalling Windows. A clean rebuild may be appropriate if compromise is confirmed, security settings cannot be trusted, or unexplained malicious activity continues despite cleanup. Preserve important evidence and consult IT on a managed PC. Reinstalling cannot revoke stolen account sessions; handle those from a trusted device.
Related Defender detection: Gridinsoft also has a path-based cleanup guide for Trojan:Win32/Skeeyah.A!rfn, especially when Defender quarantines an item from browser cache or a download folder.
Another script downloader alert: If Defender shows TrojanDownloader:JS/Nemucod instead of Wacatac, follow this Nemucod cleanup and cache-triage guide before restoring or excluding the file.
Related Defender alert: For a packed-file warning such as Trojan:Win32/VMProtect, this VMProtect false-positive and removal guide explains how to check the source, signature, path, and scan results.
References
- Microsoft Security Intelligence. “Trojan:Win32/Wacatac.B!ml threat description.” Microsoft, updated March 5, 2026, accessed November 5, 2026. Trojan:Win32/Wacatac.B!ml threat description
- Microsoft Support. “Virus and Threat Protection in the Windows Security App.” Microsoft Support, accessed November 5, 2026. Scan options and protection settings
- Microsoft Security Intelligence. “Submit a file for malware analysis.” Microsoft, accessed November 5, 2026. Submit a file for malware analysis
- Microsoft Support. “Protection History in the Windows Security App.” Accessed November 5, 2026. Protection history actions and status
- Microsoft Learn. “How Microsoft names malware.” Updated September 10, 2026; accessed November 5, 2026. Malware naming conventions.
- Dylan Beattie. “Windows Defender detects Trojan:Script/Wacatac.B!ml in a zipped .NET 9 AOT binary.” December 9, 2024; accessed November 5, 2026. Developer’s archived build report.
