Hacker News Reader

leeman2016

Got a (hopefully false-positive) virus alert on Windows 11 from Defender:

> Trojan:Win32/Sabsik.FL.A!ml

> Details: This program is dangerous and executes commands from an attacker.

Maybe due to UPX?

I see it's written in Go and some antiviruses love to mark Go executables as viruses because Go bundles the whole Go runtime inside the executable, and so the antivirus' heuristics marks it as a virus, just because it shares the same Go runtime inside as some other random unrelated virus written in Go (the antivirus has no idea it's just runtime code, it just sees that the executables' machine code matches by something like ~95%)

Reply on news.ycombinator.com