Attention! Received Trojan from Laragon (false positive, ngrok)

[EWB24]

Attention! Received Trojan from Laragon

Trojan:Win32/Wacatac.H!ml

file: D:\laragon-NEU\bin\ngrok\ngrok.exe

Laragon 8.1

[leokhoa]

Ngrok opens a tunnel to the public so it is suspicious.
The ngrok binary bundled with Laragon is signed:

You can also download ngrok here:
https://ngrok.com/downloads/windows?tab=download

[EWB24]

And how should I proceed?

[leokhoa]

Check the signature of the binary file: D:\laragon-NEU\bin\ngrok\ngrok.exe
If there is no digital signature, it is hijacked.

If there is, check with VirusTotal
https://www.virustotal.com/gui/home/upload

If it passes with many vendors, it means is false positive. I believe it is false positive if it is signed. Ngrok is a famous software.
If you want to make sure, you can extract the download zip file, check the signature and replace the old one. Latest version of Ngrok may fix the issue.

[EWB24]

I download the zip file but is infected

Trojan:Win32/Wacatac.H!ml (Windews Defender)

and Virustotal:

[AWqxKAWERbXo]

This could be a false positive, too.

[leokhoa]

Yes, it could be a false positive. Also Ngrok is a popular tool, you downloaded it from its official website and the software is signed (authentic).

[EWB24]

The "ngrok" folder is empty at the moment.

How can I reinstall this ngrok without viruses and trojan?

[leokhoa]

@EWB24: How long have you been using Laragon?
I remember you've been a long-time user. What's going on now?
Did you read my comment? #1202 (reply in thread)

If you're concerned, feel free to contact Ngrok support directly.

Also, make sure to exclude the Laragon installation folder from Windows Defender. It can significantly speed up your development process. Defender might be monitoring thousands of files in your environment, which slows things down.

[EWB24]

@EWB24: How long have you been using Laragon?

I used Laragon 6 beaded about 6 months and since the 28th February 2025 Laragon with a license. Have this problem only since yesterday.

[EWB24]

Yes, I have now excluded the Laragon folder from Defender.

What do I actually need ngrok for?
I read something that you were planning to uninstall ngrok for Laragon 8.

[leokhoa]

@EWB24 : If you don't need to share your project publicly, you don't need Ngrok.
I had considered removing Ngrok from Laragon because it was causing these issues, but I decided to keep it as Ngrok is digitally signed, and the alerts were false positives.
You can ignore it until Ngrok supports make you feel it is safe.

[EWB24]

Thank you @leokhoa,

No, I don't need to share a project publicly, I'm just testing locally.
I deleted the ngrok folder and everything seems to work as usual. I will continue to use Laragon without ngrok.

I am not a professional and I don't use Laragon every day.
But anyway, I am very happy and satisfied that I can use Laragon instead of Xampp.

Sorry for my beginner questions!

Anyway, thank you very much for your work.

[istiyakamin]

It's great to hear you found a solution by removing the ngrok folder! Sometimes antivirus software can flag legitimate tools like ngrok as false positives, especially if they interact with network connections. Always make sure to download Laragon from the official GitHub repository or website to ensure you're getting a clean version. Happy coding!

[Anke]

I just downloaded Laragon from its website. While executing Laragon I got this message:

[EWB24]

The solution is to delete the ngrok folder as mentioned above.

[leokhoa]

Thanks @EWB24. The above Ngrok version (3.18.4) is old. I have updated to the latest version of Ngrok (3.34.0) in Laragon 8.4.0
https://github.com/leokhoa/laragon/releases/tag/8.4.0

Hope it fix the issue with AV.