Delta Executor Antivirus False Positive — Whitelist Guide

Antivirus tools flag Delta Executor because of how it runs, not because the file is malicious. Every fix on this page — Windows Defender, Malwarebytes, or an Android antivirus app — is a scoped exclusion or whitelist entry that covers Delta Executor specifically, never a step that disables real-time protection. Disabling protection, even temporarily, removes every other detection the software provides along with the false positive, and isn’t necessary on any platform covered here.

Why Antivirus Flags Delta Executor

Delta Executor injects code into the running Roblox process to execute scripts — the same behavior pattern used by screen recorders, debugging tools, and overlay software like Discord’s, and the same pattern malware uses to steal data or hijack a process. Heuristic detection — antivirus engines that flag behavior patterns rather than confirmed malicious code — can’t tell the two apart at the moment of injection, so it flags both identically. This produces named detections like Trojan:Win32/Wacatac (including the Wacatac.B!ml variant, where “ml” indicates Microsoft’s machine-learning classifier made the call from behavior alone, not a human-confirmed signature) and PUA:Win32/GameHack, a “potentially unwanted application” label rather than a confirmed-malware classification. Neither name means the file is malicious; both mean the behavior looked similar enough to flag.

How to Whitelist Delta Executor in Windows Defender

  • Press Win + S, search “Windows Security,” and open it.
  • Select Virus & threat protection.
  • Under “Virus & threat protection settings,” select Manage settings.
  • Scroll to Exclusions and select Add or remove exclusions.
  • Select Add an exclusion, then Folder.
  • Browse to and select the folder where the Delta Executor file you downloaded is saved — Delta has no native Windows install folder, so whitelist only that location. Do not exclude the entire Downloads folder or an entire emulator installation directory — either would leave unrelated files unscanned. A scoped exclusion leaves that one location unscanned, so keep it as narrow as possible.
  • Confirm the selection — Defender stops scanning that folder without disabling protection anywhere else on the device.

If Defender already quarantined a Delta Executor file before the exclusion was added, open Protection history, find the entry, and select Restore. The exclusion applies to everything inside the selected folder, so it only needs setting once per install location. Malwarebytes keeps its own allow list, separate from Windows Defender’s exclusions — adding one doesn’t cover the other, so both need a separate entry if both are installed.

How to Whitelist Delta Executor in Malwarebytes

  • Open Malwarebytes and go to Settings.
  • Select the Allow List tab.
  • Select Add.
  • Choose Allow a file or folder.
  • Browse to the Delta Executor folder and select it.
  • Confirm the entry.

Whitelisting Delta Executor on Android

Android antivirus apps use a few standard categories for this kind of flag, and none of them indicate confirmed malware for Delta Executor specifically:

  • PUP (Potentially Unwanted Program) — Not malware; the app requests permissions the scanner considers unusual for its category
  • HackTool — A generic category for apps capable of modifying another running process, matching Microsoft’s documented PUA:Win32/HackTool classification
  • Riskware — The app could be misused, not that it is inherently malicious

To resolve the flag: open the antivirus app, find Delta Executor under quarantined or scanned items, and mark it as safe or add it to the app’s whitelist or trusted-apps list.

  • Open the antivirus app, find Delta Executor under quarantined or scanned items, and mark it as safe or add it to the app’s whitelist or trusted-apps list.
  • If a specific antivirus app has no whitelist or trusted-apps option at all, leave the app quarantined on that device and install Delta Executor through a platform where whitelisting is available instead — not to disable real-time protection to force the install.

Verify the File Before Whitelisting Anything — Whitelisting should only ever apply to a file confirmed to match its published source, never to a file from an unfamiliar link or mirror. The published SHA256 hash — aab977d7c42e79151df437118dec9b06d1d4693262ffd642ff44086efd025259 — lets the file be checked against the source value before it is whitelisted or run; a file producing a different hash has been altered and should be deleted rather than excluded from scanning. A matching hash confirms the file is identical to the published source — it does not confirm the file is safe. Identity and safety are separate questions.

Detection Names That Mean Real Malware

Some detection names indicate a genuine problem with the specific file being scanned, not a false positive from injection behavior:

Detection Name Pattern

Concern

Trojan.Stealer.*

Credential / cookie stealer

Spyware.*

Keylogger or surveillance malware

Backdoor.*

Remote access trojan

Ransomware.*

File encryption malware

Downloader.* with 20+ detections

May pull additional malware

A file scanning under any of these names is not a Delta Executor false positive — it should not be installed or whitelisted. Deleting the file and downloading again from the source that published the SHA256 hash above resolves this; whitelisting a file with one of these detection names does not.

Related Guides

VirusTotal Scan Guide

Ban Risk Guide

Update Fix Guide

Legal & ToS Guide

Related safety topics are covered on the Delta Executor safety guide; for the complete overview, see Delta Executor.