Skip to main content

User login

What is OpenID?
  • Log in using OpenID
  • Cancel OpenID login
  • Create new account
  • Request new password
Register
  • Home
  • Browse
    • 2D Art
    • 3D Art
    • Concept Art
    • Textures
    • Music
    • Sound Effects
    • Documents
    • Featured Tutorials
  • Submit Art
  • Collect
    • My Collections
    • Art Collections
  • Forums
  • FAQ
  • Leaderboards
    • All Time
      • Total Points
      • Comments
      • Favorites (All)
      • Favorites (2D)
      • Favorites (3D)
      • Favorites (Concept Art)
      • Favorites (Music)
      • Favorites (Sound)
      • Favorites (Textures)
    • Weekly
      • Total Points
      • Comments
      • Favorites (All)
      • Favorites (2D)
      • Favorites (3D)
      • Favorites (Concept Art)
      • Favorites (Music)
      • Favorites (Sound)
      • Favorites (Textures)
  • ❤ Donate
General Discussion

What is Script/Wacatac.B!ml?

Starry Skydancer
Thursday, March 7, 2024 - 14:07
Starry Skydancer's picture

Hello. My antivirus seems to be triggered by the pack of textures that I uploaded Quaternius tree textures curated | OpenGameArt.org

According to my antivirus program,  "quaternius_trees.7z" contains a "trojan virus" called "Script/Wacatac.B!ml". Is this actually a virus? I don't want to accidentally spread malware.

This response is only triggered when I zip the files together into a .7z, and doesn't occur when the files are on their own or when I download the files from their original author, which makes me think it may be a false positive?

Update: "Script/Wacatac.B!ml" appears to be the real name of a real virus, and all of my .7z files seem to trigger detection. Could it be mistaken identity? The fact it's all .7z files and only .7z files that my antivirus detects as containing this specific virus and I created these  .7z files just seems to weird to not be a mistake. Why didn't I detect this virus anywhere else? My intuition is that this is a false positive but I don't wnat to be too complacent.

Update: The more I think about, it the more I think it's a false positive

  • Log in or register to post comments
eugeneloza
joined 11 years 2 weeks ago
Friday, March 8, 2024 - 00:27

Tried your https://opengameart.org/content/ps1-trees through VirusTotal - looks clean, I cannot access the file you've linked. Which antivirus marks it as dangerous? Some things like Windows Defender are just outrigt stupid (and can easily mark 7z as a virus simply because it's not Microsoft's endorced(enforced) format).

Also do a full computer scan (with the antivirus that detects the virus), maybe some nasty thing crawled in between publishing those two assets. You may need to reboot in safe mode (press F8 repeatedly during Windows boot sequence) to verify some system files.

  • Log in or register to post comments
Starry Skydancer
joined 2 years 2 months ago
Friday, March 8, 2024 - 04:31
Starry Skydancer's picture

I removed the file I uploaded, only later to realise that ALL my.7z files where effected. I have Windows Defender and chances are  a 7-zip  archive just isn't in it's lsit of approved file types, I did a full scan and it detects no issue when I don't have 7-zip archives.  I may have been a overcautious to react the way I did. Looks like a false-positive. 

  • Log in or register to post comments
eugeneloza
joined 11 years 2 weeks ago
Friday, March 8, 2024 - 05:05

Indeed, I've checked the file from the link I've posted and it's fine. I'm using ZoneAlarm antivirus, also checked by VirusTotal sends the file to dozens of online antiviruses.

Note that full scan of your PC might still be a good idea. Some nasty viruses "mess with the files as they open" so if some worm crawls in your memory it may try to infect 7z, fails to, but is caught while doing so by Windows Defender. Because I-was-almost-joking about "format"; while it is technically possible, it still too silly even for Microsoft :)

  • Log in or register to post comments
MedicineStorm
joined 13 years 1 month ago
Friday, March 8, 2024 - 13:03
MedicineStorm's picture

@Starry Skydancer: Did you want me to republish the stuff you took down due to the false positive? Or are you still verifying what's going on?

BTW I really appreciate you proactively looking out for everyone, even if it turns out there was not really any risk.

--Medicine Storm

 

  • Log in or register to post comments
Starry Skydancer
joined 2 years 2 months ago
Saturday, March 9, 2024 - 05:14
Starry Skydancer's picture

Yes please, I think I was being overly anxious about it. That incldes the photomanipulated tree textures, I'd be upset to lose that pack- I'm afraid I no longer have it.

  • Log in or register to post comments