github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-07 00:22:43 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[GH-ISSUE #2519] Windows defender alert & false-positive detection #47986

New Issue
Closed
opened 2026-04-28 06:18:43 -05:00 by GiteaMirror · 61 comments
GiteaMirror commented 2026-04-28 06:18:43 -05:00
Owner
Copy Link

Originally created by @allandclive on GitHub (Feb 15, 2024).
Original GitHub issue: https://github.com/ollama/ollama/issues/2519

Originally assigned to: @dhiltgen on GitHub.

Captureq

Originally created by @allandclive on GitHub (Feb 15, 2024). Original GitHub issue: https://github.com/ollama/ollama/issues/2519 Originally assigned to: @dhiltgen on GitHub. ![Captureq](https://github.com/ollama/ollama/assets/43777357/c6f0dd3f-fdc9-4635-9b19-1ccaafc2414c)
GiteaMirror added the bugwindows labels 2026-04-28 06:18:48 -05:00
GiteaMirror commented 2026-04-28 06:18:51 -05:00
Author
Owner
Copy Link

@jmorganca commented on GitHub (Feb 15, 2024):

Hi @allandclive, would it be possible to make sure your virus is up to date? Ollama on Windows preview is a new piece of software, signed with an EV certificate by DigiCert. To state the obvious: no trojan script is packaged with Ollama.

Windows Defender has a history of flagging CUDA libraries (which Ollama includes). Will work to figure out how to make sure this doesn't appear any more.

<!-- gh-comment-id:1947145236 --> @jmorganca commented on GitHub (Feb 15, 2024): Hi @allandclive, would it be possible to make sure your virus is up to date? Ollama on Windows preview is a new piece of software, signed with an EV certificate by DigiCert. To state the obvious: no trojan script is packaged with Ollama. Windows Defender has a [history](https://forums.developer.nvidia.com/t/windows-defender-flags-cudnn64-6-dll-as-trojan-win32-peals-f-cl/56734) of flagging CUDA libraries (which Ollama includes). Will work to figure out how to make sure this doesn't appear any more.
GiteaMirror commented 2026-04-28 06:18:52 -05:00
Author
Owner
Copy Link

@allandclive commented on GitHub (Feb 15, 2024):

It's up to date

<!-- gh-comment-id:1947152466 --> @allandclive commented on GitHub (Feb 15, 2024): It's up to date
GiteaMirror commented 2026-04-28 06:18:53 -05:00
Author
Owner
Copy Link

@fristhon commented on GitHub (Feb 15, 2024):

+1
AFAIK code signing takes some days to get approved by Microsoft

<!-- gh-comment-id:1947227801 --> @fristhon commented on GitHub (Feb 15, 2024): +1 AFAIK code signing takes some days to get approved by Microsoft
GiteaMirror commented 2026-04-28 06:18:53 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (Feb 15, 2024):

Digging around, it seems this false positive is common for Inno Setup based installers.
Since we just got our signing key in the past few days, I'm inclined to wait a little bit to see if this self-corrects. If not, then we may want to take a look at the uninstall aspects here which seem be be what triggers this AV detection logic according to others who have hit this false positive.

<!-- gh-comment-id:1947369273 --> @dhiltgen commented on GitHub (Feb 15, 2024): Digging around, it seems this false positive is common for Inno Setup based installers. Since we just got our signing key in the past few days, I'm inclined to wait a little bit to see if this self-corrects. If not, then we may want to take a look at the uninstall aspects [here](https://github.com/ollama/ollama/blob/windows-preview/app/ollama.iss#L113-L117) which seem be be what triggers this AV detection logic according to others who have hit this false positive.
GiteaMirror commented 2026-04-28 06:18:54 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (Feb 15, 2024):

To test my theory above, I've produced a test build of the installer that removes 2 of plausible uninstall paths ("{%TEMP}\ollama*" and "{%USERPROFILE}\.ollama") that may be resulting in this AV flag. Would someone who's seen this AV warning be willing to give this installer a try and report back?

https://github.com/dhiltgen/ollama/releases/download/v0.1.25/OllamaSetup.exe

<!-- gh-comment-id:1947525825 --> @dhiltgen commented on GitHub (Feb 15, 2024): To test my theory above, I've produced a test build of the installer that removes 2 of plausible uninstall paths (`"{%TEMP}\ollama*"` and `"{%USERPROFILE}\.ollama"`) that may be resulting in this AV flag. Would someone who's seen this AV warning be willing to give this installer a try and report back? https://github.com/dhiltgen/ollama/releases/download/v0.1.25/OllamaSetup.exe
GiteaMirror commented 2026-04-28 06:18:55 -05:00
Author
Owner
Copy Link

@rezonant commented on GitHub (Feb 16, 2024):

For me the file listed on the Github README identifies as Trojan:Win32/Sabsik.FL.A!ml on Windows Defender (Windows 11).

Uploading that to VirusTotal yields no flags: https://www.virustotal.com/gui/file/80f7cb53c6ddba62076bcffabf926e070bec78587ee4a927208165f8afe9afce

I scanned your updated installer and it does not flag Windows Defender for me, but I did upload it to VirusTotal as well and it did hit a flag on Microsoft's AV for Trojan:Win32/Wacatac.B!ml as originally reported.

https://www.virustotal.com/gui/file/68157bfc0a9385a0aaf809e6621a6d6de5219a8444b22573ce483269fc25fe1d/details

<!-- gh-comment-id:1947695404 --> @rezonant commented on GitHub (Feb 16, 2024): For me the file listed on the Github README identifies as `Trojan:Win32/Sabsik.FL.A!ml` on Windows Defender (Windows 11). Uploading that to VirusTotal yields no flags: https://www.virustotal.com/gui/file/80f7cb53c6ddba62076bcffabf926e070bec78587ee4a927208165f8afe9afce I scanned your updated installer and it does not flag Windows Defender for me, but I did upload it to VirusTotal as well and it did hit a flag on Microsoft's AV for `Trojan:Win32/Wacatac.B!ml` as originally reported. https://www.virustotal.com/gui/file/68157bfc0a9385a0aaf809e6621a6d6de5219a8444b22573ce483269fc25fe1d/details
GiteaMirror commented 2026-04-28 06:18:56 -05:00
Author
Owner
Copy Link

@Leonai-do commented on GitHub (Feb 16, 2024):

Screenshot 2024-02-16 122900
Kaspersky also detect some files with trojans

<!-- gh-comment-id:1948824194 --> @Leonai-do commented on GitHub (Feb 16, 2024): ![Screenshot 2024-02-16 122900](https://github.com/ollama/ollama/assets/23642230/9f299fa4-431e-4eaf-86ca-7cd7b80438db) Kaspersky also detect some files with trojans
GiteaMirror commented 2026-04-28 06:18:57 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (Feb 16, 2024):

Thanks for checking!

So it sounds like those two removals didn't resolve the problem. Another plausible cause is the way we carry payloads inside the primary executable, which isn't strictly necessary on windows now, so I'll start exploring a change to carry everything as installer payloads and no nesting inside the ollama binary.

<!-- gh-comment-id:1948917793 --> @dhiltgen commented on GitHub (Feb 16, 2024): Thanks for checking! So it sounds like those two removals didn't resolve the problem. Another plausible cause is the way we carry payloads inside the primary executable, which isn't strictly necessary on windows now, so I'll start exploring a change to carry everything as installer payloads and no nesting inside the ollama binary.
GiteaMirror commented 2026-04-28 06:18:57 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (Feb 16, 2024):

I've tried various permutations and our setup installer always triggers the Microsoft AV in virtustotal. The underlying ollama.exe shows clean with or without the nested payloads. Maybe Microsoft just doesn't trust our cert yet.

<!-- gh-comment-id:1949419658 --> @dhiltgen commented on GitHub (Feb 16, 2024): I've tried various permutations and our setup installer always triggers the Microsoft AV in virtustotal. The underlying ollama.exe shows clean with or without the nested payloads. Maybe Microsoft just doesn't trust our cert yet.
GiteaMirror commented 2026-04-28 06:18:59 -05:00
Author
Owner
Copy Link

@rezonant commented on GitHub (Feb 17, 2024):

Sources online say this is common and that having a cert doesn't guarantee you aren't flagged. You need to run your releases through something like VirusTotal to identify any flags, and then submit your executable in a whitelist request to the vendors that flag it. Microsoft has a form for that, for one. After awhile you won't be flagged as your reputation grows. Good luck.

<!-- gh-comment-id:1949870990 --> @rezonant commented on GitHub (Feb 17, 2024): Sources online say this is common and that having a cert doesn't guarantee you aren't flagged. You need to run your releases through something like VirusTotal to identify any flags, and then submit your executable in a whitelist request to the vendors that flag it. Microsoft has a form for that, for one. After awhile you won't be flagged as your reputation grows. Good luck.
GiteaMirror commented 2026-04-28 06:19:00 -05:00
Author
Owner
Copy Link

@fristhon commented on GitHub (Feb 17, 2024):

Some useful insights and the form that @rezonant is talking about can be found here
https://learn.microsoft.com/en-us/microsoft-365/security/defender/criteria

<!-- gh-comment-id:1949935927 --> @fristhon commented on GitHub (Feb 17, 2024): Some useful insights and the form that @rezonant is talking about can be found here https://learn.microsoft.com/en-us/microsoft-365/security/defender/criteria
GiteaMirror commented 2026-04-28 06:19:03 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (Feb 19, 2024):

We've submitted a ticket to Microsoft so hopefully that will work through the system before we cut our next release and fix the false positives.

<!-- gh-comment-id:1953176579 --> @dhiltgen commented on GitHub (Feb 19, 2024): We've submitted a ticket to Microsoft so hopefully that will work through the system before we cut our next release and fix the false positives.
GiteaMirror commented 2026-04-28 06:19:04 -05:00
Author
Owner
Copy Link

@jmorganca commented on GitHub (Feb 21, 2024):

Hi all, wanted to post an update. As mentioned by @dhiltgen, we've contacted Microsoft to resolve this false-positive issue. It is common with Go projects (see https://go.dev/doc/faq#virus) and has affected similar projects such as Docker for Windows.

While we work on fixing this with Microsoft (we are in contact with their Security Intelligence team), you can fix the false-positive warning by updating your Windows Defender Virus Definitions:

  • Open Virus & threat protection in the Windows Security application
  • Click on Protection updates under Virus & threat protection updates:
    image
  • Click Check for updates
    image
<!-- gh-comment-id:1957880099 --> @jmorganca commented on GitHub (Feb 21, 2024): Hi all, wanted to post an update. As mentioned by @dhiltgen, we've contacted Microsoft to resolve this false-positive issue. It is common with Go projects (see https://go.dev/doc/faq#virus) and has affected similar projects such as Docker for Windows. While we work on fixing this with Microsoft (we are in contact with their Security Intelligence team), you can fix the false-positive warning by updating your Windows Defender Virus Definitions: * Open **Virus & threat protection** in the **Windows Security** application * Click on **Protection updates** under **Virus & threat protection updates**: ![image](https://github.com/ollama/ollama/assets/251292/79ceb680-3bad-4c48-87d6-5e7b0229416c) * Click **Check for updates** ![image](https://github.com/ollama/ollama/assets/251292/0eb0465b-25f2-4216-a65e-023fd439ba2f)
GiteaMirror commented 2026-04-28 06:19:05 -05:00
Author
Owner
Copy Link

@David-Woodthorpe commented on GitHub (Feb 21, 2024):

I also just had a trojan warning with Microsoft Defender when trying to update ollama - all virus definitions are up to date
image

<!-- gh-comment-id:1957962011 --> @David-Woodthorpe commented on GitHub (Feb 21, 2024): I also just had a trojan warning with Microsoft Defender when trying to update ollama - all virus definitions are up to date ![image](https://github.com/ollama/ollama/assets/4370376/5df0a2e2-a35e-473e-812c-3491e25fccc2)
GiteaMirror commented 2026-04-28 06:19:05 -05:00
Author
Owner
Copy Link

@OMGnotThatGuy commented on GitHub (Feb 21, 2024):

Security intelligence version: 1.405.380.0 still alerts false positive.

<!-- gh-comment-id:1957963521 --> @OMGnotThatGuy commented on GitHub (Feb 21, 2024): Security intelligence version: 1.405.380.0 still alerts false positive.
GiteaMirror commented 2026-04-28 06:19:07 -05:00
Author
Owner
Copy Link

@solitaryurt commented on GitHub (Feb 21, 2024):

I also just had a trojan warning with Microsoft Defender when trying to update ollama - all virus definitions are up to date

Same with v0.1.26

<!-- gh-comment-id:1958049194 --> @solitaryurt commented on GitHub (Feb 21, 2024): > I also just had a trojan warning with Microsoft Defender when trying to update ollama - all virus definitions are up to date Same with `v0.1.26`
GiteaMirror commented 2026-04-28 06:19:07 -05:00
Author
Owner
Copy Link

@internetscooter commented on GitHub (Feb 21, 2024):

Security intelligence version: 1.405.391.0 still alerts false positive.

Different alert though?

Trojan:Script/Sabsik.FL.A!ml

Capture

<!-- gh-comment-id:1958179790 --> @internetscooter commented on GitHub (Feb 21, 2024): Security intelligence version: 1.405.391.0 still alerts false positive. Different alert though? [Trojan:Script/Sabsik.FL.A!ml](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AScript%2FSabsik.FL.A!ml&threatid=2147780199) ![Capture](https://github.com/ollama/ollama/assets/630867/1f99b8e4-42aa-44e2-9987-4b3afef8ef8d)
GiteaMirror commented 2026-04-28 06:19:08 -05:00
Author
Owner
Copy Link

@solitaryurt commented on GitHub (Feb 21, 2024):

Security intelligence version: 1.405.391.0 still alerts false positive.

Different alert though?

Trojan:Script/Sabsik.FL.A!ml

These false positives are very common with Windows Golang binaries unfortunately.

<!-- gh-comment-id:1958343279 --> @solitaryurt commented on GitHub (Feb 21, 2024): > Security intelligence version: 1.405.391.0 still alerts false positive. > > Different alert though? > > [Trojan:Script/Sabsik.FL.A!ml](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AScript%2FSabsik.FL.A!ml&threatid=2147780199) These false positives are very common with Windows Golang binaries unfortunately.
GiteaMirror commented 2026-04-28 06:19:09 -05:00
Author
Owner
Copy Link

@ewebgh33 commented on GitHub (Feb 22, 2024):

Soooo does it run despite the flag and the file getting quarantined?

For me it's also Trojan:Win32/Wacatac.B!ml

<!-- gh-comment-id:1958726916 --> @ewebgh33 commented on GitHub (Feb 22, 2024): Soooo does it run despite the flag and the file getting quarantined? For me it's also Trojan:Win32/Wacatac.B!ml
GiteaMirror commented 2026-04-28 06:19:10 -05:00
Author
Owner
Copy Link

@Lunarisnia commented on GitHub (Feb 22, 2024):

image
Happened when trying to update

Right now downgrading to 0.1.25 seems to be my only option for it to not be flagged

<!-- gh-comment-id:1958755009 --> @Lunarisnia commented on GitHub (Feb 22, 2024): ![image](https://github.com/ollama/ollama/assets/50898372/5b5412aa-b473-4be5-aa5a-21536171b913) Happened when trying to update Right now downgrading to 0.1.25 seems to be my only option for it to not be flagged
GiteaMirror commented 2026-04-28 06:19:10 -05:00
Author
Owner
Copy Link

@ewebgh33 commented on GitHub (Feb 22, 2024):

I tried starting Ollama anyway. It started. BUT

When I start Ollama using WIndows Powershell, is it running the windows one or the WSL one? I would have thought Windows version, because surely only the Ubuntu prompt would start the WSL one.

Bear with me here - the reason I can't tell if it's Windows is:
1.
For ollama run llama2 it starts up pretty quick - it didn't seem to download. So is it running the model file I already downloaded for WSL?

I thought the Windows version would have it's models in the users home folder?
I looked, and C:\Users\COMPUTERFACE.ollama has no models in it. So IS it using the WSL models?
(If I download a new model, where will it go? WSL folder or windows version folder?)

Also - there's no Ollama icon in the system tray like the video said there would be for the windows version. So how do I tell if Win version is running?

Maybe this is a dumb question, but given the ambiguities I've listed I am confused.

<!-- gh-comment-id:1958841866 --> @ewebgh33 commented on GitHub (Feb 22, 2024): I tried starting Ollama anyway. It started. BUT When I start Ollama using WIndows Powershell, is it running the windows one or the WSL one? I would have thought Windows version, because surely only the Ubuntu prompt would start the WSL one. Bear with me here - the reason I can't tell if it's Windows is: 1. For `ollama run llama2` it starts up pretty quick - it didn't seem to download. So is it running the model file I already downloaded for WSL? 2. I thought the Windows version would have it's models in the users home folder? I looked, and C:\Users\COMPUTERFACE\.ollama has no models in it. So IS it using the WSL models? (If I download a new model, where will it go? WSL folder or windows version folder?) 3. Also - there's no Ollama icon in the system tray like the video said there would be for the windows version. So how do I tell if Win version is running? Maybe this is a dumb question, but given the ambiguities I've listed I am confused.
GiteaMirror commented 2026-04-28 06:19:11 -05:00
Author
Owner
Copy Link

@nagkumar commented on GitHub (Feb 22, 2024):

image

Upon an update to this version, virus alert is shown

image
<!-- gh-comment-id:1959036900 --> @nagkumar commented on GitHub (Feb 22, 2024): <img width="230" alt="image" src="https://github.com/ollama/ollama/assets/332234/06d86ac2-646a-4c45-bc7a-23249707b853"> Upon an update to this version, virus alert is shown <img width="519" alt="image" src="https://github.com/ollama/ollama/assets/332234/d4a3c5d1-95f1-4427-9a4b-68ebe06fe902">
GiteaMirror commented 2026-04-28 06:19:12 -05:00
Author
Owner
Copy Link

@Lushy3D commented on GitHub (Feb 22, 2024):

When trying to update to the newest version (v0.1.26), Windows Defender also flagged this as a threat for me on Windows 10.

Interestingly, ollama seems to be version 0.1.26 according to version info and it seems to run commands normally.

[edit] I'm not sure what part of ollama usually runs in the background, but that seems to have been killed by Windows Defender. I'll reinstall v0.1.25 for now since the newest still seems to get flagged.

ollama_update_threat

<!-- gh-comment-id:1959200528 --> @Lushy3D commented on GitHub (Feb 22, 2024): When trying to update to the newest version (v0.1.26), Windows Defender also flagged this as a threat for me on Windows 10. Interestingly, ollama seems to be version 0.1.26 according to version info and it seems to run commands normally. [edit] I'm not sure what part of ollama usually runs in the background, but that seems to have been killed by Windows Defender. I'll reinstall v0.1.25 for now since the newest still seems to get flagged. ![ollama_update_threat](https://github.com/ollama/ollama/assets/127434682/fb781f31-4ea6-4056-a46a-bf2eee4004b9)
GiteaMirror commented 2026-04-28 06:19:14 -05:00
Author
Owner
Copy Link

@schergr commented on GitHub (Feb 22, 2024):

I received the same. Let me know if you need any logs.

<!-- gh-comment-id:1959553292 --> @schergr commented on GitHub (Feb 22, 2024): I received the same. Let me know if you need any logs.
GiteaMirror commented 2026-04-28 06:19:15 -05:00
Author
Owner
Copy Link

@dasjet commented on GitHub (Feb 22, 2024):

Screenshot 2024-02-22 211151
Ollama 0.1.26.0
Kaspersky warning

<!-- gh-comment-id:1959724532 --> @dasjet commented on GitHub (Feb 22, 2024): ![Screenshot 2024-02-22 211151](https://github.com/ollama/ollama/assets/1393520/513a942c-f423-4040-b915-74092d7b57b0) Ollama 0.1.26.0 Kaspersky warning
GiteaMirror commented 2026-04-28 06:19:16 -05:00
Author
Owner
Copy Link

@davidlehub commented on GitHub (Feb 22, 2024):

same for me on windows 11. Not sure if it's really safe to "allow" it to run

<!-- gh-comment-id:1959745112 --> @davidlehub commented on GitHub (Feb 22, 2024): same for me on windows 11. Not sure if it's really safe to "allow" it to run
GiteaMirror commented 2026-04-28 06:19:17 -05:00
Author
Owner
Copy Link

@Alias4D commented on GitHub (Feb 22, 2024):

Screenshot 2024-02-22 230809

<!-- gh-comment-id:1960238226 --> @Alias4D commented on GitHub (Feb 22, 2024): ![Screenshot 2024-02-22 230809](https://github.com/ollama/ollama/assets/27604791/8d28b38d-c244-48d0-8aeb-270c4d786053)
GiteaMirror commented 2026-04-28 06:19:18 -05:00
Author
Owner
Copy Link

@MisterAG commented on GitHub (Feb 22, 2024):

Exact same error message as Alias4D above on my Win11 box, latest virus updates.

<!-- gh-comment-id:1960249032 --> @MisterAG commented on GitHub (Feb 22, 2024): Exact same error message as Alias4D above on my Win11 box, latest virus updates.
GiteaMirror commented 2026-04-28 06:19:18 -05:00
Author
Owner
Copy Link

@metathron commented on GitHub (Feb 22, 2024):

Screenshot 2024-02-22 230809

I got the same Trojan warning

<!-- gh-comment-id:1960274137 --> @metathron commented on GitHub (Feb 22, 2024): > ![Screenshot 2024-02-22 230809](https://private-user-images.githubusercontent.com/27604791/307138187-8d28b38d-c244-48d0-8aeb-270c4d786053.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MDg2MzQ0NzUsIm5iZiI6MTcwODYzNDE3NSwicGF0aCI6Ii8yNzYwNDc5MS8zMDcxMzgxODctOGQyOGIzOGQtYzI0NC00OGQwLThhZWItMjcwYzRkNzg2MDUzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDAyMjIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwMjIyVDIwMzYxNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWZiOGZiZWU1NDI0NDQ2YTg2N2IzMDk5MWM5NjE5NmVjNjkyMTk5Mjg2NThiMmUyZDA1YzliMGUwNTkyNmVlNDYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.uFdOoD2mUIEvbMl8b0Y8LszSMw-WyEtAbqIdeP-T0E8) I got the same Trojan warning
GiteaMirror commented 2026-04-28 06:19:19 -05:00
Author
Owner
Copy Link

@jmorganca commented on GitHub (Feb 23, 2024):

Hi folks, we're almost done resolving this with Microsoft. 2/3 of the binaries included with Ollama no longer seem to be triggering false alarms, one more to go and we have an ongoing ticket with Microsoft for it.

Thanks for your patience and I'm so sorry for the alert.

<!-- gh-comment-id:1960597880 --> @jmorganca commented on GitHub (Feb 23, 2024): Hi folks, we're almost done resolving this with Microsoft. 2/3 of the binaries included with Ollama no longer seem to be triggering false alarms, one more to go and we have an ongoing ticket with Microsoft for it. Thanks for your patience and I'm so sorry for the alert.
GiteaMirror commented 2026-04-28 06:19:20 -05:00
Author
Owner
Copy Link

@ahmedhamdy78 commented on GitHub (Feb 23, 2024):

still warning

<!-- gh-comment-id:1960742719 --> @ahmedhamdy78 commented on GitHub (Feb 23, 2024): ![still warning](https://github.com/ollama/ollama/assets/159552521/5752fec9-9852-4f3d-9a01-e123944eeeba)
GiteaMirror commented 2026-04-28 06:19:21 -05:00
Author
Owner
Copy Link

@jmorganca commented on GitHub (Feb 23, 2024):

Hi all, this should be much improved for the time being. I'm going to close this, with a plan to re-open it should it become a problem again. Note: it may take some time for the Windows Defender definitions to update to account for this (although all machines where I was able to reproduce it have stopped showing alerts at this point).

To everyone who hit this issue: I'm sorry and understand how shocking it might have been in the moment. I hope it doesn't deter you from giving Ollama on Windows another try.

Many more improvements to Windows to come!

<!-- gh-comment-id:1962130607 --> @jmorganca commented on GitHub (Feb 23, 2024): Hi all, this should be much improved for the time being. I'm going to close this, with a plan to re-open it should it become a problem again. Note: it may take some time for the Windows Defender definitions to update to account for this (although all machines where I was able to reproduce it have stopped showing alerts at this point). To everyone who hit this issue: I'm sorry and understand how shocking it might have been in the moment. I hope it doesn't deter you from giving Ollama on Windows another try. Many more improvements to Windows to come!
GiteaMirror commented 2026-04-28 06:19:22 -05:00
Author
Owner
Copy Link

@ewebgh33 commented on GitHub (Feb 24, 2024):

@jmorganca Will the new installer resolve the ambiguities I detailed in my message above?

My initial theory was that incomplete installation (due to virus being flagged) meant I never saw the system tray icon appear, hence not opening a new issue for this. I could never tell if the installation actually completed or not, when the virus was flagged, and I'm waiting on a new installer to try reinstalling.

Pasting the original comment here, so you don't have to scroll up:

When I start Ollama using WIndows Powershell, is it running the windows one or the WSL one? I would have thought Windows version, because surely only the Ubuntu prompt would start the WSL one.

Bear with me here - the reason I can't tell if it's Windows is:
1.
For ollama run llama2 it starts up pretty quick - it didn't seem to download. So is it running the model file I already downloaded for WSL?

I thought the Windows version would have it's models in the users home folder?
I looked, and C:\Users\COMPUTERFACE.ollama has no models in it. So IS it using the WSL models?
(If I download a new model, where will it go? WSL folder or windows version folder?)

Also - there's no Ollama icon in the system tray like the video said there would be for the windows version. So how do I tell if Win version is running?

Maybe this is a dumb question, but given the ambiguities I've listed I am confused.

<!-- gh-comment-id:1962171496 --> @ewebgh33 commented on GitHub (Feb 24, 2024): @jmorganca Will the new installer resolve the ambiguities I detailed in my message above? My initial theory was that incomplete installation (due to virus being flagged) meant I never saw the system tray icon appear, hence not opening a new issue for this. I could never tell if the installation actually completed or not, when the virus was flagged, and I'm waiting on a new installer to try reinstalling. Pasting the original comment here, so you don't have to scroll up: *** When I start Ollama using WIndows Powershell, is it running the windows one or the WSL one? I would have thought Windows version, because surely only the Ubuntu prompt would start the WSL one. Bear with me here - the reason I can't tell if it's Windows is: 1. For ollama run llama2 it starts up pretty quick - it didn't seem to download. So is it running the model file I already downloaded for WSL? I thought the Windows version would have it's models in the users home folder? I looked, and C:\Users\COMPUTERFACE.ollama has no models in it. So IS it using the WSL models? (If I download a new model, where will it go? WSL folder or windows version folder?) Also - there's no Ollama icon in the system tray like the video said there would be for the windows version. So how do I tell if Win version is running? Maybe this is a dumb question, but given the ambiguities I've listed I am confused.
GiteaMirror commented 2026-04-28 06:19:24 -05:00
Author
Owner
Copy Link

@dotysan commented on GitHub (Feb 24, 2024):

Hi @EmmaWebGH, I'm new here too. But happen to have learned the answers to your questions from recently reading the source and docs. https://github.com/ollama/ollama/blob/main/docs/faq.md

I tried starting Ollama anyway. It started. BUT

If the false-threat got blocked/quarantined, you'll need to uninstall and try again with a newer release--and after updating your MS Defender crud.

When I start Ollama using WIndows Powershell, is it running the windows one or the WSL one? I would have thought Windows version, because surely only the Ubuntu prompt would start the WSL one.

PowerShell is Windows not WSL. WSL is bash by default.

Bear with me here - the reason I can't tell if it's Windows is: 1. For ollama run llama2 it starts up pretty quick - it didn't seem to download. So is it running the model file I already downloaded for WSL?

I thought the Windows version would have it's models in the users home folder? I looked, and C:\Users\COMPUTERFACE.ollama has no models in it. So IS it using the WSL models? (If I download a new model, where will it go? WSL folder or windows version folder?)

https://github.com/ollama/ollama/blob/main/docs/faq.md#where-are-models-stored

Also - there's no Ollama icon in the system tray like the video said there would be for the windows version. So how do I tell if Win version is running?

This is likely due to the quarantine/blocking. See above.

Maybe this is a dumb question, but given the ambiguities I've listed I am confused.

There are no dumb questions.

I've been able to use it by downloading the source and compiling from scratch. No Defender alerts!

Not to tricky, but does require you carefully satisfy all the dependencies--some not fully documented yet. https://github.com/ollama/ollama/blob/main/docs/development.md#windows

<!-- gh-comment-id:1962179519 --> @dotysan commented on GitHub (Feb 24, 2024): Hi @EmmaWebGH, I'm new here too. But happen to have learned the answers to your questions from recently reading the source and docs. https://github.com/ollama/ollama/blob/main/docs/faq.md > I tried starting Ollama anyway. It started. BUT If the false-threat got blocked/quarantined, you'll need to uninstall and try again with a newer release--and after updating your MS Defender crud. > > When I start Ollama using WIndows Powershell, is it running the windows one or the WSL one? I would have thought Windows version, because surely only the Ubuntu prompt would start the WSL one. PowerShell is Windows not WSL. WSL is bash by default. > > Bear with me here - the reason I can't tell if it's Windows is: 1. For `ollama run llama2` it starts up pretty quick - it didn't seem to download. So is it running the model file I already downloaded for WSL? > > > I thought the Windows version would have it's models in the users home folder? I looked, and C:\Users\COMPUTERFACE.ollama has no models in it. So IS it using the WSL models? (If I download a new model, where will it go? WSL folder or windows version folder?) https://github.com/ollama/ollama/blob/main/docs/faq.md#where-are-models-stored > > > Also - there's no Ollama icon in the system tray like the video said there would be for the windows version. So how do I tell if Win version is running? This is likely due to the quarantine/blocking. See above. > > Maybe this is a dumb question, but given the ambiguities I've listed I am confused. There are no dumb questions. I've been able to use it by downloading the source and compiling from scratch. No Defender alerts! Not to tricky, but does require you carefully satisfy all the dependencies--some not fully documented yet. https://github.com/ollama/ollama/blob/main/docs/development.md#windows
GiteaMirror commented 2026-04-28 06:19:26 -05:00
Author
Owner
Copy Link

@jphat commented on GitHub (Feb 24, 2024):

ollama 0.1.27 and intelligence 1.405.505.0 produces no errors for me

<!-- gh-comment-id:1962238747 --> @jphat commented on GitHub (Feb 24, 2024): ollama 0.1.27 and intelligence 1.405.505.0 produces no errors for me
GiteaMirror commented 2026-04-28 06:19:27 -05:00
Author
Owner
Copy Link

@ewebgh33 commented on GitHub (Feb 25, 2024):

@dotysan

You're saying if it was quarantined it WOULDN'T start? Because it did. A file was supposedly quarantined and yet I can run llama2 from Powershell.

Thanks for the link to where the models are stored / docs.
But... there are no models in that folder! (nothing in Windows: C:\Users<username>.ollama\models)
And yet... Ollama started and ran llama2 it started and responded to prompts.

Hence my confusion, and I'm still confused.

<!-- gh-comment-id:1962907349 --> @ewebgh33 commented on GitHub (Feb 25, 2024): @dotysan You're saying if it was quarantined it WOULDN'T start? Because it did. A file was supposedly quarantined and yet I can run llama2 from Powershell. Thanks for the link to where the models are stored / docs. But... there are no models in that folder! (nothing in Windows: C:\Users\<username>\.ollama\models) And yet... Ollama started and ran llama2 it started and responded to prompts. Hence my confusion, and I'm still confused.
GiteaMirror commented 2026-04-28 06:19:28 -05:00
Author
Owner
Copy Link

@dotysan commented on GitHub (Feb 25, 2024):

You're saying if it was quarantined it WOULDN'T start? Because it did.

I did not say that.

This issue about the false-positive is closed. If you have another issue, open a new one.

If you are curious about the client/server architecture of the ollama Go binary (as I was), read the source, documentation, or watch some videos about it. https://www.youtube.com/@technovangelist

<!-- gh-comment-id:1963010460 --> @dotysan commented on GitHub (Feb 25, 2024): > You're saying if it was quarantined it WOULDN'T start? Because it did. I did not say that. This issue about the false-positive is closed. If you have another issue, open a new one. If you are curious about the client/server architecture of the ollama Go binary (as I was), read the source, documentation, or watch some videos about it. https://www.youtube.com/@technovangelist
GiteaMirror commented 2026-04-28 06:19:28 -05:00
Author
Owner
Copy Link

@boessu commented on GitHub (May 13, 2024):

Today I've got a warning from Windows Defender that ollama app.exe is infected with Trojan:Win32/Wacatac.H!ml. Is that a false positive too?

<!-- gh-comment-id:2108544666 --> @boessu commented on GitHub (May 13, 2024): Today I've got a warning from Windows Defender that ollama app.exe is infected with Trojan:Win32/Wacatac.H!ml. Is that a false positive too?
GiteaMirror commented 2026-04-28 06:19:29 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (May 13, 2024):

Sorry you hit this. We've submitted the latest release binaries to the false positive site to get it resolved.

<!-- gh-comment-id:2108915831 --> @dhiltgen commented on GitHub (May 13, 2024): Sorry you hit this. We've submitted the latest release binaries to the false positive site to get it resolved.
GiteaMirror commented 2026-04-28 06:19:30 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (May 31, 2024):

I haven't heard and fresh reports of false positives, so I'll close this.

<!-- gh-comment-id:2142996274 --> @dhiltgen commented on GitHub (May 31, 2024): I haven't heard and fresh reports of false positives, so I'll close this.
GiteaMirror commented 2026-04-28 06:19:31 -05:00
Author
Owner
Copy Link

@mhubregtse commented on GitHub (Aug 1, 2024):

Hi today i wanted to install ollama on a Bitdefender protected machine, it triggers as a trojan Atc4.Detection.
So it seems the problem has returned ?

<!-- gh-comment-id:2262467442 --> @mhubregtse commented on GitHub (Aug 1, 2024): Hi today i wanted to install ollama on a Bitdefender protected machine, it triggers as a trojan **Atc4.Detection**. So it seems the problem has returned ?
GiteaMirror commented 2026-04-28 06:19:32 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (Aug 1, 2024):

@mhubregtse can you share which ollama version, and which file triggered the AV detection?

<!-- gh-comment-id:2264197266 --> @dhiltgen commented on GitHub (Aug 1, 2024): @mhubregtse can you share which ollama version, and which file triggered the AV detection?
GiteaMirror commented 2026-04-28 06:19:32 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (Aug 2, 2024):

We'll get the latest binaries submitted to msft to clear up the false positive. We recently updated Go versions so that likely explains why it's popping up again.

<!-- gh-comment-id:2266123534 --> @dhiltgen commented on GitHub (Aug 2, 2024): We'll get the latest binaries submitted to msft to clear up the false positive. We recently updated Go versions so that likely explains why it's popping up again.
GiteaMirror commented 2026-04-28 06:19:33 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (Aug 9, 2024):

It should be clear by now. If anyone is still seeing the false positive pop up, please let us know.

<!-- gh-comment-id:2278856915 --> @dhiltgen commented on GitHub (Aug 9, 2024): It should be clear by now. If anyone is still seeing the false positive pop up, please let us know.
GiteaMirror commented 2026-04-28 06:19:36 -05:00
Author
Owner
Copy Link

@aios-ai commented on GitHub (Aug 13, 2024):

Just today I got the first false-positive detection:
image

<!-- gh-comment-id:2285770465 --> @aios-ai commented on GitHub (Aug 13, 2024): Just today I got the first false-positive detection: ![image](https://github.com/user-attachments/assets/79e27adf-abee-4639-8f01-daa66badd91f)
GiteaMirror commented 2026-04-28 06:19:38 -05:00
Author
Owner
Copy Link

@pschaer commented on GitHub (Aug 13, 2024):

same here:
image

<!-- gh-comment-id:2285978360 --> @pschaer commented on GitHub (Aug 13, 2024): same here: ![image](https://github.com/user-attachments/assets/3c717df9-3c29-4438-af8b-913bc15fa8e7)
GiteaMirror commented 2026-04-28 06:19:39 -05:00
Author
Owner
Copy Link

@mfarme commented on GitHub (Aug 13, 2024):

Same here
image

Edition Windows 11 Home
Version 23H2
Installed on ‎7/‎2/‎2023
OS build 22635.4010
Experience Windows Feature Experience Pack 1000.22700.1035.0

<!-- gh-comment-id:2286515689 --> @mfarme commented on GitHub (Aug 13, 2024): Same here ![image](https://github.com/user-attachments/assets/70b76d61-c644-465f-9184-f4aae5021f64) Edition Windows 11 Home Version 23H2 Installed on ‎7/‎2/‎2023 OS build 22635.4010 Experience Windows Feature Experience Pack 1000.22700.1035.0
GiteaMirror commented 2026-04-28 06:19:40 -05:00
Author
Owner
Copy Link

@xaydras-2 commented on GitHub (Aug 13, 2024):

I updated ollama, before it finishes, window detected a Trojan. It did finish downloading
Capture

<!-- gh-comment-id:2286863896 --> @xaydras-2 commented on GitHub (Aug 13, 2024): I updated ollama, before it finishes, window detected a Trojan. It did finish downloading ![Capture](https://github.com/user-attachments/assets/0fa07d32-fb4d-4759-83f6-0c1520cd4e3b)
GiteaMirror commented 2026-04-28 06:19:41 -05:00
Author
Owner
Copy Link

@TraoreMorike commented on GitHub (Aug 13, 2024):

Hello,

Same here :

Windows 11 Pro 23H2

image

<!-- gh-comment-id:2286907206 --> @TraoreMorike commented on GitHub (Aug 13, 2024): Hello, Same here : Windows 11 Pro 23H2 ![image](https://github.com/user-attachments/assets/c72821bb-222e-4232-b8ac-02c3bf5fb0c7)
GiteaMirror commented 2026-04-28 06:19:42 -05:00
Author
Owner
Copy Link

@livioenrico commented on GitHub (Aug 14, 2024):

For me the same today:


Threat removed
14/08/2024 08:15

Severe

Detected: Trojan:Script/Wacatac gil
Status: Removed or restored

This threat or app was removed from quarantine or
restored to the device.

Date: 14/08/2024 08:15
Details: This program is dangerous and executes
commands from an attacker.

Affected items:

file: C:\Users\Win10\AppData\Local\Programs\Ollama\ollama app.exe

file: C:\Users\Win10\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ollama.ink

file: C:\Users\Win10\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ollama\Ollama nk

file: C:\Users\Win10\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\Ollamaink

startup: C:\Users\Win10\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ollama.ink

startup: C:\Users\Win10\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ollama\Ollama.nk

startup: C:\Users\Win10\AppData\Roaming\Microsoft\Windows\start Menu\Programs\Startup\Ollamaink
<!-- gh-comment-id:2288076453 --> @livioenrico commented on GitHub (Aug 14, 2024): For me the same today: ``` Threat removed 14/08/2024 08:15 Severe Detected: Trojan:Script/Wacatac gil Status: Removed or restored This threat or app was removed from quarantine or restored to the device. Date: 14/08/2024 08:15 Details: This program is dangerous and executes commands from an attacker. Affected items: file: C:\Users\Win10\AppData\Local\Programs\Ollama\ollama app.exe file: C:\Users\Win10\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ollama.ink file: C:\Users\Win10\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ollama\Ollama nk file: C:\Users\Win10\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\Ollamaink startup: C:\Users\Win10\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ollama.ink startup: C:\Users\Win10\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ollama\Ollama.nk startup: C:\Users\Win10\AppData\Roaming\Microsoft\Windows\start Menu\Programs\Startup\Ollamaink ```
GiteaMirror commented 2026-04-28 06:19:43 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (Aug 14, 2024):

@livioenrico please confirm this was version 0.3.5 that was flagged, correct? 0.3.6 shouldn't trigger the false positive.

<!-- gh-comment-id:2289284329 --> @dhiltgen commented on GitHub (Aug 14, 2024): @livioenrico please confirm this was version 0.3.5 that was flagged, correct? 0.3.6 shouldn't trigger the false positive.
GiteaMirror commented 2026-04-28 06:19:43 -05:00
Author
Owner
Copy Link

@jpaveg commented on GitHub (Aug 14, 2024):

@livioenrico please confirm this was version 0.3.5 that was flagged, correct? 0.3.6 shouldn't trigger the false positive.

For me, 0.3.6 was flagged. It triggered after hitting 'restart to update'.

<!-- gh-comment-id:2289513552 --> @jpaveg commented on GitHub (Aug 14, 2024): > @livioenrico please confirm this was version 0.3.5 that was flagged, correct? 0.3.6 shouldn't trigger the false positive. For me, 0.3.6 was flagged. It triggered after hitting 'restart to update'.
GiteaMirror commented 2026-04-28 06:19:44 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (Sep 3, 2024):

@jpaveg or others, are you still seeing AV false positives with the latest versions?

<!-- gh-comment-id:2327223380 --> @dhiltgen commented on GitHub (Sep 3, 2024): @jpaveg or others, are you still seeing AV false positives with the latest versions?
GiteaMirror commented 2026-04-28 06:19:46 -05:00
Author
Owner
Copy Link

@jpaveg commented on GitHub (Sep 3, 2024):

@jpaveg or others, are you still seeing AV false positives with the latest versions?

I haven't seen any false positives since reinstalling.

<!-- gh-comment-id:2327225162 --> @jpaveg commented on GitHub (Sep 3, 2024): > @jpaveg or others, are you still seeing AV false positives with the latest versions? I haven't seen any false positives since reinstalling.
GiteaMirror commented 2026-04-28 06:19:47 -05:00
Author
Owner
Copy Link

@mfarme commented on GitHub (Sep 3, 2024):

@dhiltgen updated today and no issues.

<!-- gh-comment-id:2327234230 --> @mfarme commented on GitHub (Sep 3, 2024): @dhiltgen updated today and no issues.
GiteaMirror commented 2026-04-28 06:19:49 -05:00
Author
Owner
Copy Link

@xaydras-2 commented on GitHub (Sep 3, 2024):

Since the last update, there isn't any false positive

<!-- gh-comment-id:2327319783 --> @xaydras-2 commented on GitHub (Sep 3, 2024): Since the last update, there isn't any false positive
GiteaMirror commented 2026-04-28 06:19:50 -05:00
Author
Owner
Copy Link

@jaseva commented on GitHub (Sep 17, 2024):

Tried downloading today and received this warning:
image

https://ollama.com/download

<!-- gh-comment-id:2355947130 --> @jaseva commented on GitHub (Sep 17, 2024): Tried downloading today and received this warning: <img width="318" alt="image" src="https://github.com/user-attachments/assets/259c2923-16b6-4d1e-bf61-fd75a9779664"> https://ollama.com/download
GiteaMirror commented 2026-04-28 06:19:51 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (Sep 17, 2024):

I've confirmed the 0.3.10 (currently latest) binary is signed with our signing key, and uploaded it to Virus Total, and it reports clean (including McAffee's VT integration)

@jaseva do you have the latest definitions installed from McAfee?

<!-- gh-comment-id:2356367124 --> @dhiltgen commented on GitHub (Sep 17, 2024): I've confirmed the 0.3.10 (currently latest) binary is signed with our signing key, and uploaded it to Virus Total, and it reports [clean](https://www.virustotal.com/gui/file/3be19a085685324066762f33c46c4a1121f27e7a1ea9b441d0becf57dbb34375/details) (including McAffee's VT integration) @jaseva do you have the latest definitions installed from McAfee?
GiteaMirror commented 2026-04-28 06:19:52 -05:00
Author
Owner
Copy Link

@jaseva commented on GitHub (Sep 17, 2024):

Hi @dhiltgen, I only have the McAfee WebAdvisor Extension plugin installed in Microsoft Edge and I do not see any section to manually update the definitions. I assume the definitions are managed automically. My browser and extension are up to date.

image
<!-- gh-comment-id:2356392906 --> @jaseva commented on GitHub (Sep 17, 2024): Hi @dhiltgen, I only have the McAfee WebAdvisor Extension plugin installed in Microsoft Edge and I do not see any section to manually update the definitions. I assume the definitions are managed automically. My browser and extension are up to date. <img width="632" alt="image" src="https://github.com/user-attachments/assets/9abcb2c0-7c87-496c-84d6-f58bb24b448d">
GiteaMirror commented 2026-04-28 06:19:53 -05:00
Author
Owner
Copy Link

@dhiltgen commented on GitHub (Sep 17, 2024):

I tried to submit our installer to their portal for false positive disputes, but it doesn't accept large files so I was unable to complete the process. @jaseva if you have an account with McAfee, can you try to upload?

<!-- gh-comment-id:2356633914 --> @dhiltgen commented on GitHub (Sep 17, 2024): I tried to submit our installer to their portal for false positive disputes, but it doesn't accept large files so I was unable to complete the process. @jaseva if you have an account with McAfee, can you try to upload?
GiteaMirror commented 2026-04-28 06:19:54 -05:00
Author
Owner
Copy Link

@jaseva commented on GitHub (Sep 17, 2024):

Hi @dhiltgen I submitted a form to McAfee asking that they check the software and update the definitions for their WebAdvisor tool. I'll update this ticket when they reply. The upload form would only accept a maximum file size of 500 MB.

<!-- gh-comment-id:2356655249 --> @jaseva commented on GitHub (Sep 17, 2024): Hi @dhiltgen I submitted a form to McAfee asking that they check the software and update the definitions for their WebAdvisor tool. I'll update this ticket when they reply. The upload form would only accept a maximum file size of 500 MB.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label bug windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#47986
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?