What you see
The download disappears, or w0a vanishes after working once, and your security tool reports something like Trojan:Win32/Wacatac or a generic HackTool / PUA label.
Why it happens
An optimizer does, by design, several things malware also does: it writes machine-wide registry settings, changes services, adjusts power plans and restarts Explorer. Behaviour-based detection cannot tell the intent apart from the action, so tools that score on behaviour flag this whole category of software.
Generic names are the tell. Wacatac, Zusy, Score, HackTool, PUA and anything ending in .gen are heuristic buckets, not identifications of a specific known threat.
Do not just add an exclusion — check first
Being told "it's a false positive, click allow" is exactly what real malware would want you to hear. Check, then decide:
The Digital Signatures tab in the file's Properties shows whether it carries a signature and in whose name; somebody else's name there is a reason to stop. Either way, a signature cannot tell you the file is the exact build we published. The hash is the check that decides:
- Compare the file's SHA-256 with the one published on our download page:
Get-FileHash .\w0a-*.exe -Algorithm SHA256- If it matches, the file is byte-for-byte the one we published, and no third party altered it in transit.
If the hash does not match, the detection may be correct — about that file. Delete it and download again from w0a.app.
After it checks out
Allow this one file in your security tool — the exact file whose hash you just checked, not a whole folder or drive. Every tool words it differently; look for "Allowed threats", "Restore and allow on device" or "Exclusions".
Windows Defender: Windows Security → Virus & threat protection → Protection history to restore the item, then Manage settings → Exclusions (choose File, not Folder) so it is not taken again.
Why we do not simply make detections stop
We cannot. Vendors score behaviour, and this product's behaviour is what it is. What we can do is make the file verifiable, which is the part that actually protects you — a hash we publish before you download, so you can prove the file is the one we shipped.
If a detection persists on a file whose hash checks out, report it to the vendor as a false positive — most have a submission page — and tell us which tool and which name it used.
Related
Did this page help?
What was missing, or what did not work? We read every one of these.
If this page did not solve it, write to us — say which article you read, and we will fix the article.