Hi!
Today my WIN10 find a threat in this file... is located in C:\Windows\System32

win10 says is Trojan:Win32/Wacatac.DF!ml, but I think it's a false positive

does anyone know what that file is for? I had to restore it because with the quarantined file some R2R plugins no longer opened

 

Looks like this is part of Liquid Sonics "Seventh Heaven" protection bypass. Their "Illusion" release also puts R2RLSILS.dll file in System32 directory.

 

I have illusion installed and i have R2RLSILS.dll but it doesn't show up as a virus here. What are the plugins that don't work anymore? Some more details could be very useful to understand better.
Ok, so, in my system32 dir i have these two files: "R2REMPBF.dll" (on details says "RSR BigFrqEQ Helper") and "R2RLSILS.dll" (on details says "R2R Illusion Helper") both of this are not listed as virus, i don't have the other one but like BambooPestle suggested is probably related to Seventh Heaven, which i don't have installed, if it's related to that you probably should have issues only with that plugin or with this three: Liquidsonics Seventh Heaven, LiquidSonics Illusion and Empirical labs Big FrEQ, if you have issues with only this three plugins you can add them to exclusion and you're good to go but i cannot be sure about the one you have and if it's related to Seventh Heaven since i don't have that installed.

 

Last edited: Jan 14, 2021

I confirm that libraries exist.

They should be something that 'injected' into R2R modified plugins for emulating 'decryption or encryption'.

Only some presets protected software have them.Such as BigFrEQ and LiquidSonics 7th Heaven.
String 'R2REMPBF.dll Decrypt Encrypt Init IsUseDongle' found in BigFrEQ binary.

Edited:
LS7HP.dll is protected, need to unpack them to fig out what they are doing.

SHA-1: F0AC62DFEB313974A09437676B80777E194542DF
just check it.​

 

Last edited: Jan 14, 2021

@Toli Paste a hash of that file, and if someone has the same file without any virus detector throwing a fit then they can confirm if their hash is the same

 

R2RLS7HP.dll looks fine on my Win10 (1909) system too here.
Hash using Powershell:
Run Powershell, then type:
Get-FileHash C:\Windows\System32\R2RLS7HP.dll
Result: SHA256
F9FCDA4D4A50F4758856EB168465CEF2A03866887882558221D806D0A43FC7E1

R2RLSILS.dll
E633B7C148DD13B71D0A0D49B97F78C96D8339A03BCB4843666DD6B71A0FDC85

 

Last edited: Jan 14, 2021

I think you can add that to exclusions as it seems related to LiquidSonics Seventh Heaven but again you should give some more details about the plugins that don't work anymore if the dlls are the three mentioned before probably win10 have blacklisted also the other two dlls related to LiquidSonics Illusion and Empirical labs Big FrEQ.

 

Last edited: Jan 14, 2021

Yes , Seven Heaven was blacklisted and disappear from my project! I restored the file to the folder and everything is back ok

thanks everyone for the answers!

 

R2RLSILS.dll Hash: E633B7C148DD13B71D0A0D49B97F78C96D8339A03BCB4843666DD6B71A0FDC85
R2RLS7HP.dll Hash: F9FCDA4D4A50F4758856EB168465CEF2A03866887882558221D806D0A43FC7E1

 

having the same problem since yesterday. Windows Defender keeps deleting the file, even after making an exception

 

same problem as @alwin1

 

Yup.. my window defender yesterday also trigger by Trojan:Win32/Wacatac.DF!ml ... but not for long after a minute it was nothing, not even in windows defender list anymore, i did a full scan with malwarebytes and defender.. nothing bad came up.. all clean.. but im still curious and wondering what is that wacatac is..

 

https://virusscan.jotti.org/en-GB/filescanjob/trht8o2b5t

 

False positives are rare these days. ^^