gotools - trojan - windows version

[bellagio]

trafficstars

[rusq]

Can you post the SHA256 of the file?

Or maybe have you tried to submit this to i.e. virustotal? Could be false positive.

[visualfc]

• please download liteidex37.1-1.windows-qt5.9.5.zip (build for Go1.14.1)

• build gotools self go get -u github.com/visualfc/gotools go get -u github.com/visualfc/gocode

Windows/Linux: copy GOPATH/bin gotools and gocode to liteide/bin

[behindthecodex]

Bump up, I got same issue here. Checked in virustotal, liteidex37.1.windows-qt5.9.5. got 9 from 72 scan and liteidex37.1-1.windows-qt5.9.5 got 13 issue

Its contacting 192.168.122.104 ,

but I think, no severed case from that ip. Maybe google just collecting data. Any one with same experience?

(edit) https://www.virustotal.com/gui/file/ad27cc8fa1ccce84d03ffd1bd3f4843e188f398f6536819d19e8f48013322a31/detection

[stvoidit]

nice. all .exe files are infected

[westfly]

virus delete by mcafee

[rusq]

I have a feeling that this is a false positive based on signature match that spooks the antivirus software. There is a discussion on Google Groups where people are facing the same detection when checking the "Windows/386 binaries built with -ldflags -s -w"

@visualfc can you please provide the exact steps that are used to build the windows version of gocode and gotools files that are bundled in this archive so we could try and replicate this?

Probably these:

• environment used to build it, i.e. linux container or windows vm with version
• go toolset used
• command line flags
• script that executes the build

Is the script to build it somewhere in this repo?

[visualfc]

@rusq https://github.com/visualfc/liteide/blob/x37.1/build/build_windows_386_mingw32.cmd https://github.com/visualfc/liteide/blob/x37.1/build/build_windows_mingw32.cmd go install -ldflags "-s" -v github.com/visualfc/gotools ...

[visualfc]

remove -ldflags "-s" and rebuild. https://github.com/visualfc/liteide/releases/download/x37.1/liteidex37.1-2.windows-qt5.9.5.zip

[bellagio]

remove -ldflags "-s" and rebuild. https://github.com/visualfc/liteide/releases/download/x37.1/liteidex37.1-2.windows-qt5.9.5.zip

I downloaded and it looks good.

[marang]

remove -ldflags "-s" and rebuild. https://github.com/visualfc/liteide/releases/download/x37.1/liteidex37.1-2.windows-qt5.9.5.zip

Does not look good to me, still have the same threat warning

update: building those 2 works, its also mentioned above already: go get -u github.com/visualfc/gotools go get -u github.com/visualfc/gocode

[rghenciu]

the problem is still not solved https://www.virustotal.com/gui/file/0ac4acfdcdc2bbafbf500fe594603a6fc369cd6369e1da39ef66a7c34ef01963/detection please build new working version without virus detection Thank you!

[marang]

the problem is still not solved https://www.virustotal.com/gui/file/0ac4acfdcdc2bbafbf500fe594603a6fc369cd6369e1da39ef66a7c34ef01963/detection please build new working version without virus detection Thank you!

did you try to build gotools an gocode by yourself? go get -u github.com/visualfc/gotools go get -u github.com/visualfc/gocode

[balakrishnangithub]

For me its gomodifytags.exe

[marang]

For me its gomodifytags.exe

can confirm, getting the same warning. by downloading, extracting and scanning. run: go get -u -v github.com/fatih/gomodifytags and go install github.com/fatih/gomodifytags go to your build directory and scan it there, no trojan found -> copy gomodifytags.exe to your liteide\bin\ directory

[visualfc]

https://github.com/visualfc/liteide/releases/download/x37.1/liteidex37.1-3.windows-qt5.9.5.zip