Hello @martynhare, https://github.com/ValveSoftware/Proton/issues/4738#issuecomment-814271235 is relevant here.
@kisak-valve I did a little further digging and if these PE files (including all the DLLs) can be Authenticode signed under the same conditions as the native PE Windows binaries Valve ships for its Windows Steam client, that should resolve the issue without needing to submit the files to Microsoft every time a new Proton build is compiled. It appears to be the Extended Cloud Check which triggers these false positives, where copies of the files get uploaded to Microsoft servers for analysis. This check doesn't happen with binaries signed by trusted Microsoft partners.
The on-device checks all pass fine for Microsoft Defender as can be demonstrated when using VirusTotal to check the files.
Digitally signing PE binaries should be done as part of best practices anyway, so perhaps this serves as a good excuse to get it done? :)
Several other open source software are getting these random Wacatac ML detections since about a month ago. Windows Defender is completely broken at the moment.
https://github.com/RPCS3/rpcs3/issues/15309
https://github.com/PCSX2/pcsx2/issues/10878
Impact: Minor (has simple workaround, doesn't affect most users)
Affected versions: Proton 9.0 Beta (2805730)
EXE files bundled with Proton are currently being detected as Trojan:Win32/Wacatac.B!ml by Microsoft security products, even as they are being downloaded.
Steps to reproduce:
Recommended fix:
Submit files to Microsoft to have them excluded from detections as it's clearly a bunch of false positives. If these are actual proper native PE files, maybe digitally signing them using the same certs Valve does for Windows Steam binaries might help inhibit future false positives, since these files probably won't change much between Wine releases.
These include:
2805730\files\lib\wine\i386-windows\certutil.exe
2805730\files\lib\wine\i386-windows\netsh.exe
2805730\files\lib\wine\i386-windows\fc.exe
2805730\files\lib\wine\i386-windows\regini.exe
2805730\files\lib\wine\i386-windows\icacls.exe
2805730\files\lib\wine\i386-windows\dpnsvr.exe
2805730\files\lib\wine\i386-windows\aspnet_regiis.exe
2805730\files\lib\wine\i386-windows\svchost.exe
Screenshot of false positive result: