Reputation: 180
I have a program that I compiled on two different versions of Windows so it can run on more systems:
64bit Windows 10: MinGW64, MSYS2, SDL2 v2.26.0 and later, g++ 13.2.0 make
32bit Windows Vista SP2: MinGW, msys.bat, SDL2 v2.0.3, g++ 9.2.0 make
The source code is very similar, apart from using https://github.com/meganz/mingw-std-threads to replace std::thread in MinGW in the Windows Vista version.
When I ran the program compiled on Windows Vista on Windows 10, Windows Defender flagged it for Win32/Wactac.B!ml
. When I made an exception in Windows Defender the program ran fine. I tried to strip
the exe in msys.bat, but it had no effect other than cutting the file size in half.
I submitted it to https://www.microsoft.com/en-us/wdsi/filesubmission/ under PUA (Potentially unwanted programs) False Positive so Windows Defender wouldn't flag it. I am not sure how to interpret the response I got. It listed (!) Cloud: Program:Win32/Wacapew.C!ml
and (!) Cloud: Trojan:Win32/Sabsik.FLA!ml
(Screenshot).
The submitted files do not meet our criteria for malware or potentially unwanted applications. No detection will be added for these files. More detailed information about the approach and criteria categories currently used by the Microsoft researchers are available here: https://docs.microsoft.com/windows/security/threat-protection/intelligence/criteria
What do Win32/Wactac.B!ml
and other things do? How can I configure MinGW/msys.bat to not include Win32/Wactac.B!ml
in the compiled program?
Upvotes: 0
Views: 136