Hacker News new | ask | show | jobs
by leeman2016 739 days ago
Got a (hopefully false-positive) virus alert on Windows 11 from Defender:

> Trojan:Win32/Sabsik.FL.A!ml

> Details: This program is dangerous and executes commands from an attacker.

Maybe due to UPX?

1 comments

I see it's written in Go and some antiviruses love to mark Go executables as viruses because Go bundles the whole Go runtime inside the executable, and so the antivirus' heuristics marks it as a virus, just because it shares the same Go runtime inside as some other random unrelated virus written in Go (the antivirus has no idea it's just runtime code, it just sees that the executables' machine code matches by something like ~95%)