[GH-ISSUE #3168] WIndows security: ALERT: Trojan:Script/Wacatac.B!ml detected #1952

New Issue

GiteaMirror · 2026-04-12T12:05:58-05:00

GiteaMirror commented

2026-04-12 12:05:58 -05:00

Originally created by @jabbor on GitHub (Mar 15, 2024).
Original GitHub issue: https://github.com/ollama/ollama/issues/3168

Originally assigned to: @dhiltgen on GitHub.

This program is dangerous and executes commands from an attacker.

File C:\Users\xxxxxxxxx\AppData\Local\Programs\Ollama\ollama app.exe

Originally created by @jabbor on GitHub (Mar 15, 2024). Original GitHub issue: https://github.com/ollama/ollama/issues/3168 Originally assigned to: @dhiltgen on GitHub. This program is dangerous and executes commands from an attacker. File C:\Users\xxxxxxxxx\AppData\Local\Programs\Ollama\ollama app.exe

GiteaMirror closed this issue

2026-04-12 12:05:59 -05:00

GiteaMirror commented

2026-04-12 12:06:00 -05:00

@eramax commented on GitHub (Mar 15, 2024):

just clicked on restart to update ollama and then windows definder killed it

@eramax commented on GitHub (Mar 15, 2024): ![image](https://github.com/ollama/ollama/assets/542413/272e4a27-02ef-4940-b705-e874a93f8b25) just clicked on restart to update ollama and then windows definder killed it

GiteaMirror commented

2026-04-12 12:06:00 -05:00

@eramax commented on GitHub (Mar 15, 2024):

this issue v0.1.29 and not the previous versions. I had to rollback to previous version

@eramax commented on GitHub (Mar 15, 2024): this issue v0.1.29 and not the previous versions. I had to rollback to previous version

GiteaMirror commented

2026-04-12 12:06:00 -05:00

@dhiltgen commented on GitHub (Mar 15, 2024):

Sorry about the false positive. We've submitted this to Microsoft, and it should be correctly identified in the next malware definitions update.

@dhiltgen commented on GitHub (Mar 15, 2024): Sorry about the false positive. We've submitted this to Microsoft, and it should be correctly identified in the next malware definitions update.

GiteaMirror commented

2026-04-12 12:06:00 -05:00

@jabbor commented on GitHub (Mar 15, 2024):

Many thanks for the update!

@jabbor commented on GitHub (Mar 15, 2024): Many thanks for the update!

GiteaMirror commented

2026-04-12 12:06:01 -05:00

@dhiltgen commented on GitHub (Mar 20, 2024):

I'm going to close this now as we're not hearing reports of any more false positives. If you still see an AV warning with updated definitions, let us know.

@dhiltgen commented on GitHub (Mar 20, 2024): I'm going to close this now as we're not hearing reports of any more false positives. If you still see an AV warning with updated definitions, let us know.

GiteaMirror commented

2026-04-12 12:06:01 -05:00

@ethan-tqa commented on GitHub (Aug 13, 2024):

I encountered this issue today.

@ethan-tqa commented on GitHub (Aug 13, 2024): I encountered this issue today.

GiteaMirror commented

2026-04-12 12:06:02 -05:00

@codespearhead commented on GitHub (Aug 13, 2024):

Make sure your Windows and antivirus virus definitions are updated, and that you're running Ollama v0.3.5.

@codespearhead commented on GitHub (Aug 13, 2024): Make sure your [Windows](https://support.microsoft.com/en-us/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a) and [antivirus virus definitions](https://support.avast.com/en-us/article/update-antivirus/#pc) are updated, and that you're running [Ollama v0.3.5](https://github.com/ollama/ollama/releases/tag/v0.3.5).

GiteaMirror commented

2026-04-12 12:06:02 -05:00

@plashenkov commented on GitHub (Aug 13, 2024):

I have the latest Windows with latest antivirus definitions, Ollama 0.3.5, and Windows Defender blocks and deletes the app.

@plashenkov commented on GitHub (Aug 13, 2024): I have the latest Windows with latest antivirus definitions, Ollama 0.3.5, and Windows Defender blocks and deletes the app.

GiteaMirror commented

2026-04-12 12:06:03 -05:00

@mnmartinelli commented on GitHub (Aug 13, 2024):

I have encountered the same issue today

@mnmartinelli commented on GitHub (Aug 13, 2024): I have encountered the same issue today

GiteaMirror commented

2026-04-12 12:06:03 -05:00

@codespearhead commented on GitHub (Aug 13, 2024):

I cannot reproduce it.

Ollama Version

"%USERPROFILE%\AppData\Local\Programs\Ollama\ollama" --version

# ollama version is 0.3.5

Windows Version

ver

# Microsoft Windows [version 10.0.22631.3958]

Microsoft Defender Virus Definitions Version

"C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate -Query

# Service Version: 4.18.24070.5
# Engine Version: 1.1.24070.3
# AntiSpyware Signature Version: 1.417.92.0
# AntiVirus Signature Version: 1.417.92.0
# Signature update finished. No updates needed

Windows Defender Scan

"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "%USERPROFILE%\AppData\Local\Programs\Ollama\ollama app.exe"

Scan starting...
Scan finished.
Scanning C:\Users\...\AppData\Local\Programs\Ollama\ollama app.exe found no threats.

"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "%USERPROFILE%\AppData\Local\Programs\Ollama\ollama.exe"

Scan starting...
Scan finished.
Scanning C:\Users\...\AppData\Local\Programs\Ollama\ollama.exe found no threats.

Windows Defender Excluded Paths

powershell.exe -Command "Get-MpPreference | Select-Object -ExpandProperty ExclusionPath"

# Neither the scanned executables nor their parent folders are listed on my machine

@codespearhead commented on GitHub (Aug 13, 2024): I cannot reproduce it. ## Ollama Version ```cmd "%USERPROFILE%\AppData\Local\Programs\Ollama\ollama" --version ``` ```bash # ollama version is 0.3.5 ``` ## Windows Version ```cmd ver ``` ```bash # Microsoft Windows [version 10.0.22631.3958] ``` ## Microsoft Defender Virus Definitions Version ```cmd "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate -Query ``` ```bash # Service Version: 4.18.24070.5 # Engine Version: 1.1.24070.3 # AntiSpyware Signature Version: 1.417.92.0 # AntiVirus Signature Version: 1.417.92.0 # Signature update finished. No updates needed ``` ## Windows Defender Scan ```cmd "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "%USERPROFILE%\AppData\Local\Programs\Ollama\ollama app.exe" ``` ```bash Scan starting... Scan finished. Scanning C:\Users\...\AppData\Local\Programs\Ollama\ollama app.exe found no threats. ``` ```cmd "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "%USERPROFILE%\AppData\Local\Programs\Ollama\ollama.exe" ``` ```bash Scan starting... Scan finished. Scanning C:\Users\...\AppData\Local\Programs\Ollama\ollama.exe found no threats. ``` ## Windows Defender Excluded Paths ```cmd powershell.exe -Command "Get-MpPreference | Select-Object -ExpandProperty ExclusionPath" ``` ```bash # Neither the scanned executables nor their parent folders are listed on my machine ```

GiteaMirror commented

2026-04-12 12:06:04 -05:00

@dhiltgen commented on GitHub (Aug 14, 2024):

Ollama version 0.3.5 was built with a new patch version of Go 1.22.6 which seems to have triggered a new wave of false positives. We've reverted back to an older patch version of Go for 0.3.6, and submitted the binaries compiled with the newer compiler to Microsoft so when we do bump up the Go compiler version next time it should be clear.

@dhiltgen commented on GitHub (Aug 14, 2024): Ollama version 0.3.5 was built with a new patch version of Go 1.22.6 which seems to have triggered a new wave of false positives. We've reverted back to an older patch version of Go for 0.3.6, and submitted the binaries compiled with the newer compiler to Microsoft so when we do bump up the Go compiler version next time it should be clear.