Antivirus blocking legitimate software updates and installers
Security software frequently flags valid installer downloads and software updates as false positives like Trojan:Script/Wacatac.C!ml and immediately quarantines them. This disrupts the patching process, blocks file downloads, and interferes with client updates.
What the numbers show
Counted from the threads quoted below. How we count
- The most recent one is from October 2026.
- This comes up 69.3× more often in r/msp than across the site as a whole.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
- 1Disabling or bypassing security software temporarily to allow the download and installationDid this help you?
- 2Checking the Defender timeline to analyze the behaviorDid this help you?
- 3Blocking via spam filters when SPF records failDid this help you?
- 4Relying on DMARC triggers to catch bad actorsDid this help you?
- 5Closing alerts without identifying a threat and managing the underlying anxiety of potentially missing a real incident.Did this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“Has anyone else received malware detections in ScreenConnect.ClientService.exe detected as Wacatac in the past day? I'm trying to determine whether this is a false positive or a potential infection.”source ↗
“Our third-party MDR team is saying it's malicious, ConnectWise support says it's a false positive.”source ↗
“Anyone see this in their tenants? It triggers a highly malicious links alert, GCC.”source ↗
“Is anyone else seeing repeated false positives of Dell.TechHub.exe creating random rbf files or triggering services.exe?”source ↗
“Yeah that’s what we see as well, and we send hundreds of them a day 💀”source ↗
“It is not random accounts, it is our domain’s Docusign, all of them triggering the alert.”source ↗
“I am talking about legit emails from our Docusign domain”source ↗
“Been seeing this for a week or so, blocked by our spam filter as the SPF record isn't correct.”source ↗
“When I downloaded the latest on-prem installer Windows Defender ate the download right away. Detection: Trojan:Script/Wacatac.C!ml”source ↗
“Yeah same, then when i did get the installer downloaded and installed I seem to be having problems with it updating clients.”source ↗
“Yep same here. Never been an issue before with our security software but all the sudden with this update it's been getting quarantined.”source ↗
Where this came up
People with this problem also raised
- 9Why is security software generating so many false alerts?
- 2Why are legitimate vendor emails going to quarantine?
- 8Why are our Salesforce accounts getting blocked for high-risk proxies?
- 12Why do smoke detectors go off randomly in the middle of the night?
- 4Why is my passport flagged as stolen?
- 7Why does Etsy keep incorrectly flagging my items as prohibited?