Just downloaded the update for Axis and Ohs (LorbyAxisAndOhs_4_56_b19.zip) from the Just Flight website and Windows defender says the installer for MSFS2024 contains a Trojan "Detected:Trojan:Win32/Wacatac.H!ml" and quarantined the file so was unable to install, the other installers (FSX,P3D, etc) scan as clean. Could you please check the problem

This is a known issue of a false positive. Albeit a bad one, that is next to impossible to get around. It is the same on SimMarket. Apparently something changed with the global virus definition files in the last few hours(?) and the installers are now suddenly deemed "bad". A couple of days ago, all the downloads were working fine.

I've rebuilt all files and checked them with Defender - no problems. Uploaded them to SimMarket - and I can't download them, getting the same warning. Yet a full AV scan of the computer they came from, using two different AV products, did not reveal any trouble either.

Not sure what to do about this. I've reported the files as "safe" to Microsoft, maybe that will make a difference eventually. Justflight will get the new build too, and I've asked the shops to double check on their end as well.

Edited January 6Jan 6 by Lorby_SI

Thanks for quick reply.  What's weird is if I scan the zip file it comes back clean, but as soon as I unzip it the MSFS 2024 file icons doesn't change to the installer icon and the file is quarantined.

 

 

Since these messages continue to pop up, I've sent the files to Microsoft for evaluation through my developer account. No idea if this will have a positive effect or how long it will take when it does.

I just received an answer from "Microsoft Security Intelligence"

Quote

Submission details 
lorbyaxisandohs_install_msfs24.exe
Submission ID: fe478697-b0e7-439f-9148-e1c916b483a7
Status: In progress
Submitted by: 
Submitted: Jan 8, 2026 14:05:33
User Opinion: Incorrect detection
 

Analyst comments:

At this time, the submitted files do not meet our criteria for malware or potentially unwanted applications. The detection has been removed. Please follow the steps below to clear cached detections and obtain the latest malware definitions.

1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender
2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
3. Run "MpCmdRun.exe -SignatureUpdate"

Alternatively, the latest definition is available for download here: https://docs.microsoft.com/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus

 

 

Edited January 8Jan 8 by Lorby_SI