Go executable generated with go compiler triggering windows defender

Technical Discussion
1

Hello, good morning. Yesterday, after a windows update, the windows defender starts triggering my compilations as malware. The only dependences of this package is cobra cli. Had someone had same issues?

..\AppData\Local\Temp\go-build4265423361\b001\exe\a.out.exe: Operation did not complete successfully because the file contains a virus or potentially unwanted software.
2

This is normal behaviour for any virus scanner in windows. They tend to do that from time to time for any self-built program, especially if they are run from a temporary folder like that.

It might help to make your temp folder an exception, though that comes with some risk.

3

Was "not normal behavior " since yesterday. Go compiler always generated a.exe in Temp folder, and the WD never triggered that way.

4

Sadly, the behaviour changes with the virusscanner and its version/DB/whatever.

Ask your AVs developer how to ivercome this.

5

This pretty much comes down to two reasons:

  • The fact that there have been much more malwares developed with Go than desktop applications.
  • The unusual and distinguishable structure of Go binaries combined with poor virus detection algorithms by some AV vendors and anomaly-based IPSes.
6

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.