github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-06 16:11:34 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[GH-ISSUE #4134] WithSecure quarantined ollama_llama_server.exe as harmful file / Malware #28329

New Issue
Closed
opened 2026-04-22 06:25:31 -05:00 by GiteaMirror · 7 comments
GiteaMirror commented 2026-04-22 06:25:31 -05:00
Owner
Copy Link

Originally created by @sjdevcode on GitHub (May 3, 2024).
Original GitHub issue: https://github.com/ollama/ollama/issues/4134

Originally assigned to: @dhiltgen on GitHub.

What is the issue?

After updating Ollama to version 0.1.33 WithSecure Elements identified ollama_llama_server.exe as a harmful file and put it in quarantine. It classified it as "Category: Malware and Type: Exploit".

It's about ollama_llama_server.exe in the \ollama_runners\cpu_avx folder. The executables in the other ollama_runners folders are unaffected.

I assume it's a false positive. However, a solution is highly appreciated.

OS

Windows

GPU

AMD

CPU

AMD

Ollama version

0.1.33

Originally created by @sjdevcode on GitHub (May 3, 2024). Original GitHub issue: https://github.com/ollama/ollama/issues/4134 Originally assigned to: @dhiltgen on GitHub. ### What is the issue? After updating Ollama to version 0.1.33 WithSecure Elements identified ollama_llama_server.exe as a harmful file and put it in quarantine. It classified it as "Category: Malware and Type: Exploit". It's about ollama_llama_server.exe in the \ollama_runners\cpu_avx folder. The executables in the other ollama_runners folders are unaffected. I assume it's a false positive. However, a solution is highly appreciated. ### OS Windows ### GPU AMD ### CPU AMD ### Ollama version 0.1.33
GiteaMirror added the bugwindows labels 2026-04-22 06:25:31 -05:00
GiteaMirror commented 2026-04-22 06:25:36 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (May 3, 2024):

Sorry you hit this. I've submitted our binaries to WithSecure's false positive form. I didn't see a mention of their turn-around time, but most AV vendors are a few days I believe. If you're still seeing false positives by next week, please let us know.

<!-- gh-comment-id:2093806136 --> @dhiltgen commented on GitHub (May 3, 2024): Sorry you hit this. I've submitted our binaries to WithSecure's false positive form. I didn't see a mention of their turn-around time, but most AV vendors are a few days I believe. If you're still seeing false positives by next week, please let us know.
GiteaMirror commented 2026-04-22 06:25:37 -05:00
Author
Owner
Copy Link

@sjdevcode commented on GitHub (May 3, 2024):

Thank you for your quick response. I will get back to you next week if I keep seeing false positives.

<!-- gh-comment-id:2093891135 --> @sjdevcode commented on GitHub (May 3, 2024): Thank you for your quick response. I will get back to you next week if I keep seeing false positives.
GiteaMirror commented 2026-04-22 06:25:38 -05:00
Author
Owner
Copy Link

@americium241 commented on GitHub (May 7, 2024):

Hello fyi i ran in similar flagging by WithSecure today morning. just after the update to version 0.1.33
7 mai 2024 09:59:48 UTC
Exploit:W32/CVE-2020-0601.|Quarantined|On_access_scanner.file_infection.quarantine|...Ollama\ollama_runners\cpu_avx\ollama_llama_server.exe
OS : windows

<!-- gh-comment-id:2098270000 --> @americium241 commented on GitHub (May 7, 2024): Hello fyi i ran in similar flagging by WithSecure today morning. just after the update to version 0.1.33 7 mai 2024 09:59:48 UTC Exploit:W32/CVE-2020-0601.|Quarantined|On_access_scanner.file_infection.quarantine|...Ollama\ollama_runners\cpu_avx\ollama_llama_server.exe OS : windows
GiteaMirror commented 2026-04-22 06:25:39 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (May 7, 2024):

@americium241 since I've already uploaded the binaries to WithSecure for false positive resolution, I'm not sure me submitting them again will help. Since you have a business relationship with the company, can you try to submit them as well to see if that does the trick? (Or file a ticket with them pointing to our releases page so they can install the app themselves)

If I had to guess why this happened, there are malicious actors using Go to build malware, so we've seen various AV vendors trigger false positives as a result since we're also written in Go.

<!-- gh-comment-id:2099490949 --> @dhiltgen commented on GitHub (May 7, 2024): @americium241 since I've already uploaded the binaries to WithSecure for false positive resolution, I'm not sure me submitting them again will help. Since you have a business relationship with the company, can you try to submit them as well to see if that does the trick? (Or file a ticket with them pointing to our [releases page](https://github.com/ollama/ollama/releases) so they can install the app themselves) If I had to guess why this happened, there are malicious actors using Go to build malware, so we've seen various AV vendors trigger false positives as a result since we're also written in Go.
GiteaMirror commented 2026-04-22 06:25:39 -05:00
Author
Owner
Copy Link

@sjdevcode commented on GitHub (May 8, 2024):

@dhiltgen I‘ve submitted the file in question (ollama_llama_server.exe from the cpu_avx folder) to WithSecure via their built in reporting form on May 3rd.

<!-- gh-comment-id:2099951668 --> @sjdevcode commented on GitHub (May 8, 2024): @dhiltgen I‘ve submitted the file in question (ollama_llama_server.exe from the cpu_avx folder) to WithSecure via their built in reporting form on May 3rd.
GiteaMirror commented 2026-04-22 06:25:40 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (May 21, 2024):

@sjdevcode has the false positive gone away or does WithSecure still flag Ollama?

<!-- gh-comment-id:2123208732 --> @dhiltgen commented on GitHub (May 21, 2024): @sjdevcode has the false positive gone away or does WithSecure still flag Ollama?
GiteaMirror commented 2026-04-22 06:25:40 -05:00
Author
Owner
Copy Link

@sjdevcode commented on GitHub (May 26, 2024):

@dhiltgen I've run the installation process today and no false positive showed up for me.

<!-- gh-comment-id:2132270877 --> @sjdevcode commented on GitHub (May 26, 2024): @dhiltgen I've run the installation process today and no false positive showed up for me.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label bug windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#28329
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?