[Windows] Trojan alert from windows defender and other anti-virus providers

[Shotman]

Describe the bug

After building from source a Tauri app, Commandos after doing a npm run tauri dev, at some point Windows Defender freaks out and I get a Trojan:Script/Wacatac.B!ml alert from it

To Reproduce

Steps to reproduce the behavior:

1. Clone the repo
2. Run the dev process of the app
3. Use the app a bit
4. Alert shoudl happen at some point

Expected behavior

Windows Defender shouldn't flag this app as a Trojan

Platform and Versions (required):

Operating System - Windows, version 10.0.19043 X64
Webview2 - 92.0.902.73

Node.js environment
  Node.js - 16.5.0
  @tauri-apps/cli - 1.0.0-beta.7
  @tauri-apps/api - 1.0.0-beta.6

Global packages
  npm - 7.20.3
  yarn - 1.22.5

Rust environment
  rustc - 1.54.0
  cargo - 1.54.0

App directory structure
/.git
/.github
/.vscode
/e2e
/images
/logo
/node_modules
/src
/src-tauri

App
  tauri.rs - 1.0.0-beta.7
  build-type - bundle
  CSP - default-src blob: data: filesystem: ws: wss: http: https: tauri: 'unsafe-eval' 'unsafe-inline' 'self' img-src: 'self'
  distDir - ../dist/commandos
  devPath - http://localhost:5200
  framework - Angular
  bundler - Webpack

Additional context

Not my app just wanted to tested it and ran into this issue

[nothingismagick]

Should we escalate this to the webview2 crew? @wusyong

[lemarier]

MS thread; https://docs.microsoft.com/en-us/answers/questions/465937/msi-is-detected-by-windows-defender-and-it-shows-3.html

[lemarier]

Not my app just wanted to tested it and ran into this issue

Could you make a virustotal.com submission and include the report link here, please? Thanks

[Shotman]

Not my app just wanted to tested it and ran into this issue

Could you make a virustotal.com submission and include the report link here, please? Thanks

https://www.virustotal.com/gui/file/d582212961c8d2fe95b700d721d8972aa52d0b6c978e93917fddb85e419f1687/detection

[Verequies]

During testing my app on Windows I also had this experience. Came up as "Trojan:Script/Wacatac.B!ml". This was a debug build as well.

[frnco]

During testing my app on Windows I also had this experience. Came up as "Trojan:Script/Wacatac.B!ml". This was a debug build as well.

Just wanted to add that I never compiled a debug build for Windows, and Windows never complained like that for any of my non-debug-builds. Dunno if there's actually any relation to using a debug build, but I've built a few things on windows and shared with a few friends and family, and although Windows does complain quite a bit about signing and not knowing the publisher or whatever, windows defender never reported any threats like viruses or trojans or whatever, so this doesn't apply to all windows builds, and if it's not the debug-thing there's something else causing this.

[lucasfernog]

@Shotman do you still see this alert? No one else has reported it :/

[Shotman]

@lucasfernog I haven't tried it so far, but recently I've set up Tauri 1.0 on a few PCs and it didn't trigger anything sooo I guess it might be safe to assume something between beta7 and 1.0 fixed it
Closing the issue for now but let's reopen if it ever comes back

[giohappy]

FYI it also happens to me. Tauri 1.1, Windows 11, on a couple of PCs.
I built the react template, as it is.

[Endunry]

A friend of mine sent his .exe and .msi to test it on my system and my MS-Defender instantly alarms me about "Trojan:Script/Wacatac.B!ml". He doesnt get the same error as i and virustotal says its harmless.

So the issue is defently not fixed

Version used: Tauri 1.2
Windows Version: Windows 11 21H2

[kbeirne]

We've had similar experience with our Tauri app v1.2. No problems from several playtesters but have 2 new testers now and they immediately got it, as well as a block from both Chrome and Edge. Testers were on Windows 10. Similar trojan alert but slightly different name:

I've noticed a commonality between our project and Commandos. Both uses Windows cmd direct in the project. See here.
I was trying to avoid this if possible because of problems just like this. I'm gonna run a build with cmd removed and see if the issues persist.

Update: Got a second playtester recreating the issue. Tried a build without any cmd or any interop at all really except for some REST APIs (and UI), practically no extra rust outside some empty tauri::commands and an empty on_window_event->WindowEvent::Destroyed hook) and got the same result.