github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-07 00:22:43 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[GH-ISSUE #2648] Windows Defender alert on update to 0.1.26 #27330

New Issue
Closed
opened 2026-04-22 04:36:45 -05:00 by GiteaMirror · 7 comments
GiteaMirror commented 2026-04-22 04:36:45 -05:00
Owner
Copy Link

Originally created by @OMGnotThatGuy on GitHub (Feb 21, 2024).
Original GitHub issue: https://github.com/ollama/ollama/issues/2648

I didn't have any issues installing the previous packages, but it seems the latest release triggered a Malware alert in Defender on Windows 11.

Windows:
OS Name Microsoft Windows 11 Pro
Version 10.0.22631 Build 22631

Defender: - It appears Defender updated its signatures afterwards, so I don't know what version was active when the alert popped.
Security intelligence version: 1.405.380.0
Version created on: 2/21/2024 5:51 AM
Last update: 2/21/2024 2:00 PM

image

I checked the signatures and they have the same signing cert as the previous version. I uploaded the installer and app executables to VirusTotal and got one flag in addition to my Defender alert, plus some weird sandbox behavior:

OllamaSetup.exe - Blocked by Windows Defender

ollama app.exe - Blocked by Windows Defender
VirusTotal behavioral analysis claimed "ollama app.exe" dropped a copy of GoogleUpdater on their sandbox. I did not see this on my system, but I also don't have any Google software installed. ¯\_(ツ)_/¯

ollama.exe - One additional detection on VirusTotal

Originally created by @OMGnotThatGuy on GitHub (Feb 21, 2024). Original GitHub issue: https://github.com/ollama/ollama/issues/2648 I didn't have any issues installing the previous packages, but it seems the latest release triggered a Malware alert in Defender on Windows 11. **Windows:** OS Name Microsoft Windows 11 Pro Version 10.0.22631 Build 22631 **Defender:** - It appears Defender updated its signatures afterwards, so I don't know what version was active when the alert popped. Security intelligence version: 1.405.380.0 Version created on: 2/21/2024 5:51 AM Last update: 2/21/2024 2:00 PM ![image](https://github.com/ollama/ollama/assets/91296990/7fc97655-f5e2-4581-b177-064b564a6d5e) I checked the signatures and they have the same signing cert as the previous version. I uploaded the installer and app executables to VirusTotal and got one flag in addition to my Defender alert, plus some weird sandbox behavior: [OllamaSetup.exe](https://www.virustotal.com/gui/file/cacb2123e27ce31c065b723061ef6784308d77840ac0d554dd7696beb23fc542/detection) - **Blocked by Windows Defender** [ollama app.exe](https://www.virustotal.com/gui/file/5b3ca41783194ad89998ac7dae4a192d72cdffa2f4af93d6aa7b930509154cc8/detection) - **Blocked by Windows Defender** [VirusTotal behavioral analysis](https://www.virustotal.com/gui/file/5b3ca41783194ad89998ac7dae4a192d72cdffa2f4af93d6aa7b930509154cc8/behavior) claimed "ollama app.exe" dropped a copy of GoogleUpdater on their sandbox. I did not see this on my system, but I also don't have any Google software installed. ¯\\\_(ツ)_/¯ [ollama.exe](https://www.virustotal.com/gui/file/5110bd46530744ee84817f2200d0b502076187c9183ff238ed3fddf5a09bf580/detection) - **One additional detection on VirusTotal**
GiteaMirror commented 2026-04-22 04:36:46 -05:00
Author
Owner
Copy Link

@guliaka commented on GitHub (Feb 21, 2024):

+1

<!-- gh-comment-id:1957836093 --> @guliaka commented on GitHub (Feb 21, 2024): +1
GiteaMirror commented 2026-04-22 04:36:47 -05:00
Author
Owner
Copy Link

@jmorganca commented on GitHub (Feb 21, 2024):

Hi, I'm so sorry about this. It's a false positive and a common issue with Go projects (see https://go.dev/doc/faq#virus, from the Official Go website). We're working on resolving it with Microsoft Security Intelligence. For sake of tracking and updates I'm going to merge this with https://github.com/ollama/ollama/issues/2519

<!-- gh-comment-id:1957859430 --> @jmorganca commented on GitHub (Feb 21, 2024): Hi, I'm so sorry about this. It's a false positive and a common issue with Go projects (see https://go.dev/doc/faq#virus, from the Official Go website). We're working on resolving it with Microsoft Security Intelligence. For sake of tracking and updates I'm going to merge this with https://github.com/ollama/ollama/issues/2519
GiteaMirror commented 2026-04-22 04:36:47 -05:00
Author
Owner
Copy Link

@jmorganca commented on GitHub (Feb 21, 2024):

While we work on fixing this with Microsoft, you can fix the false-positive warning by updating your Windows Defender Virus Definitions:

  • Open Virus & threat protection in the Windows Security application
  • Click on Protection updates under Virus & threat protection updates:
    image
  • Click Check for updates
    image
<!-- gh-comment-id:1957873205 --> @jmorganca commented on GitHub (Feb 21, 2024): While we work on fixing this with Microsoft, you can fix the false-positive warning by updating your Windows Defender Virus Definitions: * Open **Virus & threat protection** in the **Windows Security** application * Click on **Protection updates** under **Virus & threat protection updates**: ![image](https://github.com/ollama/ollama/assets/251292/79ceb680-3bad-4c48-87d6-5e7b0229416c) * Click **Check for updates** ![image](https://github.com/ollama/ollama/assets/251292/0eb0465b-25f2-4216-a65e-023fd439ba2f)
GiteaMirror commented 2026-04-22 04:36:48 -05:00
Author
Owner
Copy Link

@planedrop commented on GitHub (Feb 22, 2024):

Also seeing this, not that it helps at all, but just chiming in for other people that may come across this thread. Glad it's a false positive and not something worse.

Love the work you're doing with this project, has been amazing.

<!-- gh-comment-id:1958677586 --> @planedrop commented on GitHub (Feb 22, 2024): Also seeing this, not that it helps at all, but just chiming in for other people that may come across this thread. Glad it's a false positive and not something worse. Love the work you're doing with this project, has been amazing.
GiteaMirror commented 2026-04-22 04:36:49 -05:00
Author
Owner
Copy Link

@OMGnotThatGuy commented on GitHub (Feb 22, 2024):

Hi, I'm so sorry about this. It's a false positive and a common issue with Go projects (see https://go.dev/doc/faq#virus, from the Official Go website). We're working on resolving it with Microsoft Security Intelligence. For sake of tracking and updates I'm going to merge this with #2519

@jmorganca: Thanks for the apology, but really it's not necessary. I work in IT Security so I just wanted to give the project a heads up before any panicked users arrived. Thanks for all your hard work!

<!-- gh-comment-id:1958680843 --> @OMGnotThatGuy commented on GitHub (Feb 22, 2024): > Hi, I'm so sorry about this. It's a false positive and a common issue with Go projects (see https://go.dev/doc/faq#virus, from the Official Go website). We're working on resolving it with Microsoft Security Intelligence. For sake of tracking and updates I'm going to merge this with #2519 @jmorganca: Thanks for the apology, but really it's not necessary. I work in IT Security so I just wanted to give the project a heads up before any panicked users arrived. Thanks for all your hard work!
GiteaMirror commented 2026-04-22 04:36:49 -05:00
Author
Owner
Copy Link

@planedrop commented on GitHub (Feb 22, 2024):

Also completely concur with @OMGnotThatGuy , no need to apologize, false positives are a normal thing.

<!-- gh-comment-id:1958682094 --> @planedrop commented on GitHub (Feb 22, 2024): Also completely concur with @OMGnotThatGuy , no need to apologize, false positives are a normal thing.
GiteaMirror commented 2026-04-22 04:36:50 -05:00
Author
Owner
Copy Link

@neanderthalbrainman commented on GitHub (Feb 22, 2024):

@jmorganca I've just downloaded and run the installer on W11 and defender is flagging and deleting it on my system.
I did update my virus definitions and retried.

image
Also here is the definition being caught:
image
Chiming in so you're aware it may still be getting flagged.

Edit 24 hours later: I saw there was an update. Added the virus sig back to defender and redownloaded the exe. Installed over the old install and no defender alert.

Thanks!

<!-- gh-comment-id:1960521059 --> @neanderthalbrainman commented on GitHub (Feb 22, 2024): @jmorganca I've just downloaded and run the installer on W11 and defender is flagging and deleting it on my system. I did update my virus definitions and retried. ![image](https://github.com/ollama/ollama/assets/110084554/8944d3dd-c59c-4b8b-8334-3613f1c8a7e0) Also here is the definition being caught: ![image](https://github.com/ollama/ollama/assets/110084554/addc86ca-9b17-48ad-945e-da104a564b12) Chiming in so you're aware it may still be getting flagged. Edit 24 hours later: I saw there was an update. Added the virus sig back to defender and redownloaded the exe. Installed over the old install and no defender alert. Thanks!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#27330
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?