Kaspersky is reporting that go1.6.2.windows-amd64.msi contains Trojan Ebowla

[kaveh256]

Kaspersky is reporting that there is a Trojan inside go1.6.2.windows-amd64.msi. See the report here.
Looking further into it, it seems it considers api.exe to contain Trojan.Win32.Ebowla.

This seems to be a recurring issue. This also happens with version 1.5 with vet.exe and pprof.exe and also a few previously filed issues.

[cespare]

I assume it's a false positive, same as those other closed issues.

[kaveh256]

It is most likely a false positive. But this is a recurring problem so maybe someone should have a look at why this is happening.

The previous ones were frozen due to age.

[as]

It occurs because Go is being leveraged to evade anti-virus software and Kaspersky is using a detection mechanism that triggers false positives.

https://github.com/Genetic-Malware/Ebowla
https://github.com/vyrus001/go-mimikatz

The "virus" is flagged as "Trojan.Win32.Ebowla." The actual virus can use Go to generate code, so Kaspersky is scanning for Go signatures to detect this virus.

[ianlancetaylor]

I don't think there is anything we can do, so closing.

Further discussion should probably take place on a forum; see https://golang.org/wiki/Questions .

[Tiberriver256]

You could submit the official binary hashes to Kaspersky for whitelisting.

http://whitelist.kaspersky.com/whitelist_program

[ianlancetaylor]

OK, @broady , want to look into that?

[broady]

OK, will look into it. The msi files are signed, so maybe we can get Kaspersky to verify Google's signing key.

[jomcn1]

FYI, Microsoft System Center Endpoint Protection is also flagging go.1.6.2.src.tar.gz as malware. It looks like it is flagging it as a Spursint.Aclc trojan, and in particular it looks like the file being flagged is go/doc/codewalk/codewalk.js.

[xRayDev]

Submit to Kaspersky lab. file C:\Go\bin\go.exe and select "Do not agree with the result".
Maybe it will help to solve this idiotic problem with their Antivirus.

[mut3]

Checkpoint Endpoint Security just started doing the same thing, must share a signature database.