Windows 11 Trojan:Win32/Wacatac.B!ml when using CustomTkInter in a pyinstaller

[hansvdam]

I spend a long time nailing this down to the source and finally removed CustomTkinter from my codebase. I want to leave some trace, because I could not find anything about this online:
I used it in an application (for windows and mac) in a pyinstaller and for windows packed using an inno-installer.
Windows Security flags the installer as Trojan:Win32/Wacatac.B!ml when I include CustomTkinter (and darkdetect) in the build. Without it everything is fine.

[MAINER4IK]

buy a certificate and make a digital signature, the library is not to blame for this in any way

[Akascape]

It's not a problem with the library itself. Getting flags from antivirus software like this is common when using PyInstaller and Inno Setup.

Solutions:

Invest in a Software Signing Certificate: If you plan to work on larger projects, obtaining a software signing certificate is recommended.
OR
Avoid Using Inno Setup: Instead, try distributing a one-file executable created using PyInstaller. Check this: #939

Experiment with Executable Packing: Check which files and libraries are triggering the antivirus.

Check in VirusTotal: Upload the executable to VirusTotal.com to check the false positive rating. If you encounter serious detections, try to contact the antivirus vendors to remove the false positives, in case you are distributing the executables in public. But 2-5 false detections are common if it's not signed.

[teijiIshida]

It's the darkdetect library (which uses winreg) that CustomTkinter is using. When packaging using auto-py-to-exe one directory, I almost always get this Watac detection and about 15-25 detections on VirusTotal. My guess is because most malwares modifies the registry, so vendors just blanket-wide detect it as bad in the signature.

I removed darkdetect and modified my CustomTkinter to still work without winreg. It still can do Dark/Light mode (but no System mode). Now, I don't get this detection anymore and VirusTotal doesn't show me 25+ false detections. I still get 7 detections from the usual crappy vendors, but I ignore them.