search

gokcehan / lf

Terminal file manager
MIT License
7.78k stars 331 forks source link

lf detected as virus by Windows Defender #1828

Open GeorgeManukyan opened 2 weeks ago

GeorgeManukyan commented 2 weeks ago

When attempting to use the lf(r33) file manager on Windows, Windows Defender detects the application as a virus and automatically deletes it.

https://www.virustotal.com/gui/file/0ad4cbeca10a8d8356f46fcba7482f99d2a0d1fe5a27096237b28761aaa5bd34

Maybe LF could be submitted to antivirus companies for review and request to have it excluded from virus definitions.

Screenshot 2024-11-02 at 21 33 44
joelim-work commented 2 weeks ago

This has been brought up a few times before:

I suspect this is happening because lf is a power-user tool that can do powerful things like executing shell commands, and this is being flagged due to heuristics.

I'm not a Windows user myself so I don't have much motivation here, but anyone who is interested can probably try submitting this as a false positive whenever there is a new release.

Limero commented 1 day ago

If I build the latest master for Windows and upload to VirusTotal, it's detected by Microsoft as Program:Win32/Wacapew.C!ml:

env GOOS=windows go build .

If I build it with debug information stripped, it doesn't get detected

env GOOS=windows go build -ldflags="-s -w" .

So it's possible we could just do this for the Windows releases and bypass antivirus checks. It will also result in smaller binaries (about 2mb smaller), so maybe we should even do the same for all releases.

Edit: I see now that we are already doing this :thinking: https://github.com/gokcehan/lf/blob/master/gen/xbuild.sh#L25