What is the Wacatac.B!ml Trojan? How to remove it from Windows?

Windows Defender warns you during periodic security scans that it has detected a threat called Trojan: Script/Wacatac.B! ML not? Have you been told that Windows Defender has tried to fix the threat but failed and that further action needs to be taken?

If so, your computer has been infected with the Wacatac Trojan that Windows Defender cannot automatically remove. In this article, TipsMake.com will discuss with you in more detail the Wacatac trojan, how it infects your computer and what you should do when this trojan appears.

What is the Wacatac.B!ml Trojan?

Wacatac.B!Ml is classified as a trojan by Windows Defender because it infiltrates the Windows operating system by tricking users into executing a legitimate-looking file.

The moment it infects your system, this trojan puts you at risk of identity theft, data virus infection, and financial loss. Moreover, it will consume a lot of resources in the background without your knowledge, resulting in slow system performance.

Therefore, you should remove it immediately. Even Microsoft Defender warns you about the dangers of this trojan in the warning section and urges you to act immediately. The question is how did Wacatac.B!Ml appear on your computer?

How does the Wacatac.B!Ml Trojan get into the PC?

To understand how the Wacatac Trojan gets into your PC, ask yourself the following questions:

1. Do you download the cracked version of the program or use the crack to activate the premium software for free?
2. Did you download old versions of any software or programs from a suspicious website?
3. In the last few days have you received a seemingly authentic email (probably a shipping invoice you don't remember making), but when you click the attachment in the email, it runs a script and suddenly disappear?
4. Do you download a movie or song using a torrent file for free?
5. Did you turn off Windows Defender or antivirus for a few days, then rescan your computer and find this threat?

If you answered yes to any of the questions above, you have found how the Wacatac trojan got into your computer. But could it be a false warning? It's also possible, so you should rule it out first.

Make sure the Wacatac.B!Ml trojan warning is correct

Did you detect the trojan infection after running a random security scan? You should make sure that the Wacatac Trojan warning is correct. Follow the steps below:

1. Go to VirusTotal website. Click the Choose file button on the VirusTotal website.

2. Navigate to the path of the affected item where Windows Defender detected the trojan. In most cases, the path will look like this:

C:WINDOWSSystem32config ystemprofileAppDataLocalMicrosoftWindowsINetCacheIEQINNLJOV.htm

3. Select the infected file and upload it.

What is the Wacatac.B!ml Trojan? How to remove it from Windows? Picture 1

If the scan reports nothing, it could be a false alarm. However, whether the file is clean or the scan detects trojans or malware, it's best to scan and remove them.

How to remove the Wacatac.B!Ml trojan from the device

If you are sure that the Wacatac threat is not a fake alert and just want to make sure that your device is not infected or the scan shows that the file you scanned is infected, you should take the following steps:

1. Delete the infected file

The first step is to delete the infected file that Windows Defender claims to be infected. Therefore, navigate to the same path mentioned above, right click on the file and select Delete.

What is the Wacatac.B!ml Trojan? How to remove it from Windows? Picture 2

After deleting the file, run the security check on the computer again. If the trojan continues to appear on the system, move on to the next fix.

If the file that Windows Defender detects as a threat is a Windows operating system file, you should exercise caution before deleting it. Otherwise, it may make your computer unbootable.

2. Manually remove the threat

Windows Security makes it easier to remove threats manually. Here are the steps to follow:

1. Press Win + I to .
2. In the left sidebar, click Privacy & security .
3. In the right pane, click Windows Security.

What is the Wacatac.B!ml Trojan? How to remove it from Windows? Picture 3

1. Click Virus & threat protection .
2. Then click Protection history.

What is the Wacatac.B!ml Trojan? How to remove it from Windows? Picture 4

1. Click on the Wacatac threat .
2. Open the Actions drop-down menu and select Remove.

What is the Wacatac.B!ml Trojan? How to remove it from Windows? Picture 5

Run the scan again. If the threat is not removed, follow the same steps and select Quarantine from the Actions drop-down menu . This will prevent the virus from spreading further. Move on to the next step.

3. Run a malware scan in Safe Mode

Usually, the presence of malware prevents Windows Defender from deleting infected files. To prevent this from happening, you should boot your device into Safe Mode first. That way, malware won't interfere with deleting infected files.

Then you should do a full scan using Windows Defender. Keep in mind that a full virus scan can take more than an hour, so be patient and let it complete. Once the scan is complete, check to see if Windows Defender is still reporting the threat. If that's the case, run a malware scan with a third-party antivirus.

Sometimes Windows Defender doesn't remove malware completely or continues to give incorrect warnings despite removing the virus. Third-party software can help you determine if a threat is present and remove it if present. If all else fails, reset the computer.

4. Reset the operating system

When none of the fixes work, you can reset Windows as a last resort. During the reset process, Windows will remove all installed applications and restore any customizations to their defaults, but your files will remain intact (if you choose to do so). TipsMake has instructions on how to factory reset your Windows device if you don't already know how.

Does the Wacatac trojan warning appear when you download the file?

Did you get a Wacatac Trojan warning when downloading a specific file from the Internet? If so, temporarily disconnect your device from the Internet. Disconnecting your PC from the Internet will prevent the trojan from infecting your system if it tries to get in.

Then, scan your computer for malware with Windows Defender to see if it detects the trojan. When it doesn't show any trojan but then shows a warning when you download the file, confirm that it's not a fake warning.

It has been reported that Wacatac Trojan warnings sometimes appear when downloading archives, especially with the .RAR extension, even from legitimate sources. If that's also the case for you, follow the steps below:

1. Copy the download link of the file you want to download.
2. Visit the VirusTotal website.
3. Enter the URL into the URL scanner.
4. Press Enter.

What is the Wacatac.B!ml Trojan? How to remove it from Windows? Picture 6

If the VirusTotal scanner returns clean results, you can download the file without worry. Just add whitelist to Windows Defender to exclude this file. If the tool detects malware, it's best not to download it.

Now, you have a better understanding of the Wacatac Trojan. If your device is infected with a virus, it will be easier to remove it now. Also, use third-party antivirus software along with Windows Defender to further secure your system.

Jessica Tanner

Update 17 February 2023