Trojan:Win32/Wacatac: What It Is and How to Remove It

Trojan:Win32/Wacatac is a Microsoft Defender detection name, not the name of one file you can simply uninstall. Keep the affected item quarantined while you check the complete alert, its source, and whether you ran it. A blocked download and a program you launched need different responses—even if both say Wacatac. False positives are possible, but the name alone cannot establish that a file is safe or tell you whether passwords were stolen.

This page covers the general Wacatac label and A!ml and C!ml alerts. For an exact H or B detection, use the dedicated Wacatac.H!ml or Wacatac.B!ml guide; both cover Win32 and Script spellings.

What does Trojan:Win32/Wacatac mean?

Microsoft’s naming scheme separates the threat type, platform, family, variant, and optional suffix. In Trojan:Win32/Wacatac.C!ml, Trojan is the type, Win32 the platform, Wacatac the family name, and C the variant letter. The letter is an identifier, not a severity grade. Microsoft describes suffixes beginning with ! as internal indicators; its public naming guide does not turn !ml into a safety verdict or a file-specific explanation of the detection algorithm. [1]

Microsoft’s Wacatac.A!ml description discusses threats that can steal information or download further malware. These are potential capabilities, not proof that every file carrying a Wacatac label performed them. Your alert’s affected object, execution history, and follow-up findings determine the response. [2]

Win32 and Script are not a danger ranking. Copy the complete label instead of shortening it to “Wacatac virus.” If another scanner reports Trojan.Wacatac, record that product too: different vendors can use different names. The Defender detection-name guide explains the broader naming system.

What about Wacatac.A!ml and Wacatac.C!ml?

Trojan:Win32/Wacatac.A!ml and Trojan:Win32/Wacatac.C!ml need the same initial evidence check. Neither the A/C letter nor a forum report about a different file tells you whether your copy is malicious. You do not need a separate removal tool for each letter.

• A/C alert as an installer finishes downloading: if you did not launch it, preserve the quarantine and verify the exact download source and version. Blocking a file before execution limits that event’s exposure; it does not make the file a false positive.
• A/C alert after you opened an installer or crack: stop using that package and scan the device. A later quarantine cannot undo actions that may already have happened.
• A/C alert in a software project or freshly compiled build: ask the developer to identify the release/build and submit the detected file for review. A familiar project folder, valid signature, or clean result from another scanner is supporting evidence, not clearance by itself.

If the detected program is WiiUDownloader and the label is B!ml, use the WiiUDownloader verification guide rather than applying an unrelated A/C or game-mod report to it.

Read the affected item before deleting anything

Open Windows Security → Virus & threat protection → Protection history, then expand the relevant card. You may need administrator privileges to see its details. Record the complete detection name, detection time, action status, full affected-item path, and what you were doing when it appeared. [3]

The path tells you which object was detected. It may point to an executable, an item inside a ZIP, or cached content. Downloads, Temp, and AppData also contain legitimate files. Do not delete one of these folders because it appears in an alert. Likewise, an MP4-looking name or a Script label is not enough to decide what ran; inspect the full filename and the actual affected object without opening it.

Illustrative example: an alert for an item inside Downloads\package.zip does not establish that its installer executed. If you later extract the same package, a new alert for the extracted file can reflect another copy from that source. It does not automatically prove a hidden startup task. Keep the detected item isolated and remove only the identified untrusted package; do not re-extract it to test the theory.

How to remove Trojan:Win32/Wacatac safely

Quarantine prevents further use of the detected item, but if an untrusted program ran, other files or startup components may remain. A full cleanup scan checks beyond the object named in the first warning.

1. Save the alert details and keep the item quarantined. Complete any pending action in Windows Security. Do not restore it so another scanner can access it.
2. Download and install Gridinsoft Anti-Malware from the official site. Update its detection database, then choose Full Scan. Run scans one at a time.
3. Review the results and apply the recommended cleanup. The scan can check files, startup entries, scheduled tasks, browser changes, and bundled components. Review an uncertain detection against the file-verification steps before allowing it.
4. Restart when requested and check the original symptom. Rescan as needed and compare any new event with your saved timestamp and path. An unchanged history card is different from a newly detected file.

You do not need to follow this scan with mandatory registry or task deletion. Use the targeted checks below only if fresh detections or symptoms remain. A clean scan improves confidence in the device’s current state; it cannot prove that no earlier account exposure occurred.

If you prefer the built-in Windows tools: update Microsoft Defender’s security intelligence, then open Scan options → Full scan. If detections persist or removal cannot complete, Microsoft Defender Offline scan restarts the PC and scans in the Windows recovery environment. Save your work first. Return to Protection history afterward to review what happened. [4]

Why does Wacatac keep coming back?

Compare time, status, and object, not just the Wacatac name:

• Same old event, resolved status, no fresh finding: the card can remain as a record of the earlier action. Do not restore the file or clear history just to remove that record.
• New event for an archive, download, or cache: check whether the original package remains, was downloaded again, or was recreated by the app. A new timestamp shows another detection, not necessarily execution. Remove the identified untrusted source through the relevant file/app controls; avoid deleting entire browser profiles or system folders.
• A file reappears after cleanup without another download: investigate what writes or launches it. If a task is implicated, record its action, arguments, trigger, and target before changing it. Disable or remove only entries connected to the unwanted activity; unfamiliar names and Temp/AppData paths are not sufficient evidence.
• Remediation incomplete: expand the card for the failed or unfinished action, then use the scan route above. Do not assume the same history entry proves reinfection.

If a fake-update redirect preceded the incident, review recently added browser extensions and notification permissions. If the affected item involves PowerShell with repeated hidden or encoded arguments, use the Commando.A!ml PowerShell investigation guide to examine the launcher; deleting or excluding powershell.exe does not resolve that cause. For detailed H/B archive, cache, and reboot scenarios, use the exact-label guides linked above.

How to check a possible Wacatac false positive

Keep the item isolated while you build a file-specific case. A search result saying “Wacatac is usually harmless” cannot validate a different file, version, or download source.

1. Verify provenance. Record the official download URL, application version, and expected publisher. A cracked installer, fake driver update, email attachment, or mirror without a verifiable publisher is a reason to keep the file out of use, not to add an exclusion.
2. Identify the exact build. Compare an available signature and SHA-256 with the developer’s release information, where published. Do not restore a quarantined item merely to calculate its hash; use existing logs or ask the developer for help. A signature identifies a signer, not every action a program might take.
3. Ask for review. Microsoft’s submission service accepts suspected malware and files believed to be incorrectly detected. Include the label and version details; a developer can submit its own build. For work files, use your IT/security team’s approved process. Do not upload confidential material to public scanners. [5]
4. Wait for a verdict that matches your file. After Microsoft or the software vendor resolves the detection, update security intelligence and obtain the verified release from its official source. Consider restoration only when the specific file is verified; avoid broad folder exclusions or disabling protection to install it.

Scanner disagreement is a reason to investigate. It is not a vote that proves safety, and a clean full-system scan while the file remains quarantined does not validate the quarantined file itself.

Do you need to change passwords or reinstall Windows?

The Wacatac name alone cannot answer either question. If the suspicious file ran and compromise is plausible, or accounts show unauthorized activity, stop sensitive work on the PC. Disconnect it while arranging cleanup if malicious activity appears active. From a separate trusted device, secure your email and important accounts, change affected passwords, revoke unrecognized sessions, review recovery details, and enable multifactor authentication. Account recovery can proceed while the PC is being cleaned.

A download blocked before you launched it does not by itself justify changing every password or reinstalling Windows. Escalate to your IT team or a qualified technician if protections remain disabled, fresh detections continue after cleanup, or you cannot establish a trustworthy system state. A clean Windows installation may be appropriate in that situation, but it is not an automatic consequence of an A, C, H, or B label.

FAQ

References

1. Microsoft Learn. Malware names. Accessed November 5, 2026.
2. Microsoft Security Intelligence. Trojan:Win32/Wacatac.A!ml threat description. Updated March 5, 2026; accessed November 5, 2026.
3. Microsoft Support. Protection History in the Windows Security App. Accessed November 5, 2026.
4. Microsoft Support. Virus and Threat Protection in the Windows Security App. Accessed November 5, 2026.
5. Microsoft Security Intelligence. Submit a file for malware analysis. Accessed November 5, 2026.