What you see
The download disappears, or w0a vanishes after working once, and your security tool reports something like Trojan:Win32/Wacatac or a generic HackTool / PUA label.
Why it happens
An optimizer does, by design, several things malware also does: it writes machine-wide registry settings, changes services, adjusts power plans and restarts Explorer. Behaviour-based detection cannot tell the intent apart from the action, so tools that score on behaviour flag this whole category of software.
Generic names are the tell. Wacatac, Zusy, Score, HackTool, PUA and anything ending in .gen are heuristic buckets, not identifications of a specific known threat.
Do not just add an exclusion — check first
Being told "it's a false positive, click allow" is exactly what real malware would want you to hear. Check, then decide:
w0a is code-signed, so the Digital Signatures tab should carry a signature in our name; a missing one, or somebody else's name, is a reason to stop. It still cannot tell you the file is the exact build we published. The hash is the check that decides:
- Compare the file's SHA-256 with the one published on our home page:
Get-FileHash .\w0a.exe -Algorithm SHA256- If it matches, the file is byte-for-byte the one we published, and no third party altered it in transit.
If the hash does not match, the detection may be correct — about that file. Delete it and download again from w0a.app.
After it checks out
Add an exclusion for the installer and for w0a's install folder in your security tool. Every tool words it differently; look for "Exclusions", "Allowed threats" or "Restore and allow on device".
Windows Defender: Windows Security → Virus & threat protection → Protection history to restore the item, then Manage settings → Exclusions so it is not taken again.
Why we do not simply make detections stop
We cannot. Vendors score behaviour, and this product's behaviour is what it is. What we can do is make the file verifiable, which is the part that actually protects you — a hash we publish before you download, so you can prove the file is the one we shipped.
If a detection persists on a file whose hash checks out, tell us which tool and which name it used. Those reports are what we send to vendors.
Related
Did this page help?
What was missing, or what did not work? We read every one of these.
If this page did not solve it, write to us — say which article you read, and we will fix the article.