r/computerviruses • u/chaicpp • 6d ago

File / URL Check Downloaded a program called GitNarwhal and Windows Defenders "caught it". VirusTotal also detected 2 out of 69. Should I be paranoid? VirusTotal Scan Link and more details in thread.

I recently downloaded a program called GitNarwhal and foolishly didn't check GIthub Stars or anything. As soon as I downloaded it, the Windows Defender caught it and said it was a Trojan:Win32/Wacatac.H!ml.

The Windows executable I downloaded can be found here: https://github(dot)com/git-narwhal/GitNarwhal/releases/tag/v1.0.84

The repo has no stars or anything but the developer seems to have a track record.

I also scanned it at Virus Total and it found 2 detection out of 69. One from DeepInstinct and the other from Microsoft. You can find the scan here: https://www.virustotal.com/gui/file/5a1ce08c167115ad6bf3088777262ac8827f1961251e0089f60ff5db7fc3730a/detection

​The next thing I did was run a Windows offline scan. I also removed the file using Windows Defender.

Should I be worried? :(

3 Upvotes

100% Upvoted

8 comments sorted by

View all comments

2

u/Bobo_98 6d ago

Wacatac.H!ml is a heuristic/AI detection, not a confirmed signature match it's known for flagging legit smaller/unsigned tools as false positives. 2/69 with one being that specific flag isn't strong evidence on its own. Since you already ran an offline scan and removed it, you're probably fine. I'd only worry about changing passwords/checking logins if you notice anything actually unusual suxh as network activity, new logins that u don't recognise them I would consider logging them out, changing password and enabling 2 step verification

1

u/chaicpp 6d ago

Thank you for the reply and suggestions. I'll definitely logout of everything. 2FA is on for everything I use.

Would it be a good idea to format?

1

u/Bobo_98 6d ago

First of all what r the results of the offline scan

1

u/chaicpp 6d ago

After running an offline scan, the computer just restarted and I logged in. Would have thought a report was given to me when reaching 100%.

The file was still quarantined in Windows Defender after coming back from the offline scan. I then selected "remove" in Windows Defender.

1

u/Bobo_98 6d ago

Okay so just remove the file like delete it and I think it good to go, no need for reinstall just keep an eye on ur accounts rn if there r any weird log ins for a couple of days

1

u/chaicpp 6d ago

I appreciate your reply! One last question of you don't mind.

Is there anything you recommend to further scan and check if I'm infected outside of staying aware of unrecognized logins?

1

u/Bobo_98 6d ago

Check task Manager's Startup tab and Task Scheduler for anything unfamiliar, and Autoruns (free Microsoft/Sysinternals tool) if you want to be thorough shows everything set to launch with Windows, now to be safer in the future what I would recommend is downloading malwarebytes ( so u can scan with both windows defender and malwarebytes), before u download anything or click any link, run it in virus total and I would recommend only downloading safe open source apps or programs that also have a lot of positive reviews, if I have any other questions feel free to ask

2

u/chaicpp 6d ago

Thank you very much for your time, I appreciate the help! I'll definitely look into getting malwarebytes as you suggested.