Gitea 1.22 detected as virus by windows defender #12844

New Issue

GiteaMirror · 2025-11-02T10:22:39-06:00

GiteaMirror commented

2025-11-02 10:22:39 -06:00

Originally created by @yp05327 on GitHub (Apr 15, 2024).

When download gitea 1.22 from dl.gitea.com, I got a warning from windows defender.
1.21.10 is fine.

Originally created by @yp05327 on GitHub (Apr 15, 2024). ![image](https://github.com/go-gitea/gitea/assets/18380374/d0fd8082-3fac-4f3a-979b-fbbbef66595a) When download gitea 1.22 from dl.gitea.com, I got a warning from windows defender. 1.21.10 is fine.

GiteaMirror added the issue/needs-feedback label 2025-11-02 10:22:39 -06:00

GiteaMirror closed this issue

2025-11-02 10:22:39 -06:00

GiteaMirror commented

2025-11-02 10:22:40 -06:00

@yp05327 commented on GitHub (Apr 15, 2024):

gitea-1.22.0-rc0-windows-4.0-amd64.exe is also ok

the detected virus is Trojan:Win32/Wacatac.B!ml

@yp05327 commented on GitHub (Apr 15, 2024): `gitea-1.22.0-rc0-windows-4.0-amd64.exe` is also ok the detected virus is `Trojan:Win32/Wacatac.B!ml`

GiteaMirror commented

2025-11-02 10:22:40 -06:00

@42wim commented on GitHub (Apr 15, 2024):

That's an issue with defender, they seem to be labeling almost every Go program with Trojan:Win32/Wacatac.B!ml
See also https://go.dev/doc/faq#virus

For fun, try compiling a go windows binary that just prints "hello world" and upload it to virustotal.com :)
(https://www.virustotal.com/gui/file/0f7a665f7bb31e36fe33daa4608799f916a365dee74df18f1d5c75615083315b?nocache=1)

@42wim commented on GitHub (Apr 15, 2024): That's an issue with defender, they seem to be labeling almost every Go program with `Trojan:Win32/Wacatac.B!ml` See also https://go.dev/doc/faq#virus For fun, try compiling a go windows binary that just prints "hello world" and upload it to virustotal.com :) (https://www.virustotal.com/gui/file/0f7a665f7bb31e36fe33daa4608799f916a365dee74df18f1d5c75615083315b?nocache=1)

GiteaMirror commented

2025-11-02 10:22:40 -06:00

@silverwind commented on GitHub (Apr 15, 2024):

Maybe it needs some kind of signature in the binary. How to other go programs avoid this?

@silverwind commented on GitHub (Apr 15, 2024): Maybe it needs some kind of signature in the binary. How to other go programs avoid this?

GiteaMirror commented

2025-11-02 10:22:41 -06:00

@silverwind commented on GitHub (Apr 15, 2024):

https://github.com/golang/vscode-go/issues/3182 looks related, but likely their fix does not apply to gitea.

@silverwind commented on GitHub (Apr 15, 2024): https://github.com/golang/vscode-go/issues/3182 looks related, but likely their fix does not apply to gitea.

GiteaMirror commented

2025-11-02 10:22:41 -06:00

@42wim commented on GitHub (Apr 15, 2024):

Afaik there is no general way for the "little man", thats the sad state of antivirus at the moment. We're having the same issue with in-house software, even with certificate signing.

You can upload it to the different antivirus vendors and have them check it and whitelist it.
https://www.microsoft.com/en-us/wdsi/filesubmission

More complaints to be found here: https://github.com/kachick/dotfiles/issues/442

@42wim commented on GitHub (Apr 15, 2024): Afaik there is no general way for the "little man", thats the sad state of antivirus at the moment. We're having the same issue with in-house software, even with certificate signing. You can upload it to the different antivirus vendors and have them check it and whitelist it. https://www.microsoft.com/en-us/wdsi/filesubmission More complaints to be found here: https://github.com/kachick/dotfiles/issues/442

GiteaMirror commented

2025-11-02 10:22:41 -06:00

@silverwind commented on GitHub (Apr 15, 2024):

Likely it just searches for some static strings in the binary which then causes the false-positive, so maybe it's possible to eliminate/obfuscate these parts of the binary. If those parts happen to be inside golang runtime parts, the issue should be reported to the golang/go repo.

https://mrd0x.com/bypass-static-detection-windows-defender/

@silverwind commented on GitHub (Apr 15, 2024): Likely it just searches for some static strings in the binary which then causes the false-positive, so maybe it's possible to eliminate/obfuscate these parts of the binary. If those parts happen to be inside golang runtime parts, the issue should be reported to the golang/go repo. https://mrd0x.com/bypass-static-detection-windows-defender/

GiteaMirror commented

2025-11-02 10:22:41 -06:00

@yp05327 commented on GitHub (Apr 15, 2024):

I can't reproduce this on my personal PC. But my PC is Windows 11.
My office's PC is Windows 10, and may have some special settings from the company (not sure).

@yp05327 commented on GitHub (Apr 15, 2024): I can't reproduce this on my personal PC. But my PC is Windows 11. My office's PC is Windows 10, and may have some special settings from the company (not sure).

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#12844