False Positive or real Trojan? Help

[xomega-alphax]

I just downloaded the AMD gpu version and widnows defender says that it contains [Trojan:Win32/Wacatac.B!ml] I even did a hash test with virus total and marks 34 of 69 scans as virius, google ai said it's totally safe to use with a false positive but chatgpt says is 70% virus 30% safe to use.

I'm completely new to using this program, so I don't know if it's really safe, and I have even more doubts because I can't find anyone else with this specific problem, can anyone help me?

[PianoNic]

maby this project was Hijacked, because the entire git history was removed on main

[blaisewf]

no virus, don't worry

[xomega-alphax]

so it's safe? so why is it being flagged as a virus?
I just want to be really cautious about this issue x.x

(and honestly, pianonic's comment doesn't help me feel confident using this program, even though I saw that it's very good x.x)

[PianoNic]

I used it before and it it really is great, but I got turned off by the collapse of the git history. But as blaisewf is a contributor and assures that this is no virus, I "think" it is save to use.

[xomega-alphax]

well i hope to get some more feedback about this because now days is really hard to trust after something like this, also if hes is is a contributor well it helps a little yup :>

[blaisewf]

Any program that includes for example BAT files (batch scripts) may be flagged as a Trojan by antivirus software because batch scripts are commonly used to modify files, install software, or make system changes, actions that malware often performs as well. However, those same actions are also perfectly normal for legitimate installers, so a detection alone does not mean the program is malicious.

In this case, it's most likely a false positive. Resetting the commit history has nothing to do with antivirus detections. The developers simply chose to start with a clean Git history, and the source code is still available for anyone to review and verify what the program does.

[PianoNic]

I'm completely on your side here. But:

Resetting the commit history has nothing to do with antivirus detections.

Agreed, the detection itself isn't the issue. My concern is/was that wiping the history removes the ability to audit the project. With a full history you can see exactly what changed, when, and by whom. With a single squashed commit, you're just trusting that the snapshot is clean.

"The source is still available for review" only helps if someone reads the entire codebase, which realistically almost nobody does. A diff against yesterday's tree is something people actually check.

So to be clear: I'm not saying anything malicious happened here. I don't think it did. I'm saying one of the usual safety nets is gone, and it disappeared around the same time as a Defender flag, which is why people are nervous.

A short note explaining why the history was reset (like an official statement) would probably clear this up for good. (I remember seeing somewhere that the lead Dev liked his version more of the project and overwrote the entire git history)

That said: thanks to all contributors for this amazing repository 🙌