When Antivirus Flags the Client, or macOS Says It Is Damaged

• The installer is not code-signed. A signing certificate has to be issued to a company or a registered trade name after identity verification, and we are still weighing that trade-off, so the installer is an “unknown publisher”. That is exactly what SmartScreen blocks — not the contents, but the fact that it does not recognise the publisher.
• The behaviour itself looks suspicious. To route system traffic into an encrypted tunnel the program creates a virtual adapter, edits the routing table and sometimes installs a driver. To a generic antivirus rule that sequence is indistinguishable from a remote-access trojan.
• The bundled cores have history. The open-source networking cores inside these clients have long-standing entries in vendor databases, so even the untouched official download gets flagged.
• This is industry-wide, not specific to us. Comparable open-source clients say the same thing in their own FAQs: if you suspect a false positive, check it on VirusTotal yourself.
• What we actually do: the desktop clients are byte-for-byte mirrors of the upstream open-source releases. We do not modify, repackage or inject anything — we host them so they download quickly from inside China.

An exclusion tells your antivirus to stop looking at a folder, so verification comes first, not second. Neither step below needs any expertise.

1. Compare the official hash. Every download entry links to the upstream project’s official release page, which publishes a SHA-256 for each installer. Open PowerShell, run Get-FileHash followed by the path to the installer, and compare the output with the official page. A match means the file is byte-identical to the official release.
2. Check it on VirusTotal. Drop the installer on virustotal.com and look at how many engines flag it. A handful of heuristic engines flagging it while the major vendors pass it is the signature of a false positive. If most major engines flag it, do not install it — contact us instead.
3. Only after both steps pass should you add the exclusion below. If the hash does not match, do not install it and tell us, so we can check the download host.

Most people notice because the program vanished after installing — it was quarantined. Restore it first, then add the exclusion, otherwise the second install is deleted too. These steps need administrator rights.

1. Open Settings → Privacy & security → Windows Security → Virus & threat protection.
2. Click Protection history and find the entry whose timestamp matches; the name is usually Trojan:Win32/Wacatac or a similar generic label.
3. Expand it and choose Allow or Restore under Actions. If the only option is Allow on device, take it.
4. Check the install folder to confirm the file is back. If there is no entry at all, SmartScreen blocked it before installation — skip to the next section.

1. On the Virus & threat protection page, scroll to Virus & threat protection settings and click Manage settings.
2. Scroll down to Exclusions and click Add or remove exclusions; confirm the administrator prompt.
3. Click Add an exclusion and choose Folder.
4. Select the client’s install folder. By default it sits under C:\Program Files in a folder named after the client; if you changed the path during setup, pick the one you actually chose.
5. If the installer itself is deleted right after downloading, add a second exclusion of type File pointing at the installer. You can remove that one once the install finishes.
6. Run the installer again. If SmartScreen shows the blue “Windows protected your PC” dialog, click More info on the left, then Run anyway.

The macOS symptom is different. Double-clicking may produce “<app> is damaged and can’t be opened. You should move it to the Trash”, or “cannot be opened because the developer cannot be verified”. The file is not damaged — Gatekeeper is refusing it. Anything downloaded through a browser gets a quarantine flag, Gatekeeper looks for an Apple developer signature and a notarization ticket, and rejects the app when neither is there. Same root cause as on Windows: we have not bought a signing identity yet.

The three steps below go from narrowest to broadest. Stop at the first one that works.

• Only run the xattr command on a file whose origin you have verified. See the verification section above — on macOS the hash command is shasum -a 256 followed by the file path.
• Do not run sudo spctl --master-disable to switch Gatekeeper off globally. That drops protection for the whole machine, while the right-click route affects one app.
• Since macOS 15 Apple has tightened the right-click path, so the System Settings step is usually required. That is a change in the OS, not a problem with the installer.
• The private network (Tailscale), OpenVPN Connect and Cisco Secure Client are all signed and notarized on macOS — double-click and go, none of the above applies.

1. In Finder → Applications, hold Control and click the icon (or right-click), choose Open, then click Open again in the dialog. This grants a one-time exception for that one app.
2. If the right-click menu has no usable Open, go to System Settings → Privacy & Security, scroll to the Security section, find “<app> was blocked because it is not from an identified developer”, click Open Anyway and confirm with your password.
3. If the message says “damaged”, the first two steps usually will not help because the system never even read a signature. Open Terminal and run xattr -dr com.apple.quarantine followed by the path to the app (normally the .app under /Applications), enter your login password, then launch it. That command removes the download quarantine flag.
4. On first launch macOS asks for your password to approve a network extension. It cannot route traffic until you approve it.

• Exclude only the client’s install folder. Never exclude the whole C: drive, your Downloads folder or your entire user profile — the wider the hole, the more room real malware has to hide in it.
• Do not turn off real-time protection to install something. That disables protection for the whole machine, while an exclusion affects one folder.
• When you stop using the client, uninstall it and remove the exclusion from the same page.
• Company-managed laptops usually have exclusions disabled by policy, so yours will not stick. Do not fight it — use one of the signed methods below.

Three of our connection methods use commercial clients signed by their own vendors. They are never flagged and never show an unknown-publisher warning. Same account, no extra cost.

• Private network (the official Tailscale client): vendor-signed, install and go, good for leaving connected all day.
• OpenVPN Connect: an OpenVPN-signed installer; import the profile and connect.
• Cisco Secure Client: an enterprise client, fully signed, and often already installed on work laptops.
• Setup steps are in the connection-method guide and in each client’s own guide.

• Chinese suites (360, Kingsoft, Tencent PC Manager): besides adding a trusted folder, note that their network-protection modules intercept encrypted connections — if it installs but will not connect, look for the network or traffic protection switch.
• Huorong: restore the file from the quarantine under virus scanning, then add the install folder under Protection Centre → Trusted zone.
• Kaspersky, Bitdefender and other international products: add the folder under Exclusions or Exceptions; the flow mirrors Windows Security.
• Running two antivirus suites at once makes them flag each other. Keep one.