Windows defender alert & false-positive detection

[allandclive]

[jmorganca]

Hi @allandclive, would it be possible to make sure your virus is up to date? Ollama on Windows preview is a new piece of software, signed with an EV certificate by DigiCert. To state the obvious: no trojan script is packaged with Ollama.

Windows Defender has a history of flagging CUDA libraries (which Ollama includes). Will work to figure out how to make sure this doesn't appear any more.

[allandclive]

It's up to date

[fristhon]

+1 AFAIK code signing takes some days to get approved by Microsoft

[dhiltgen]

Digging around, it seems this false positive is common for Inno Setup based installers. Since we just got our signing key in the past few days, I'm inclined to wait a little bit to see if this self-corrects. If not, then we may want to take a look at the uninstall aspects here which seem be be what triggers this AV detection logic according to others who have hit this false positive.

[dhiltgen]

To test my theory above, I've produced a test build of the installer that removes 2 of plausible uninstall paths ("{%TEMP}\ollama*" and "{%USERPROFILE}\.ollama") that may be resulting in this AV flag. Would someone who's seen this AV warning be willing to give this installer a try and report back?

https://github.com/dhiltgen/ollama/releases/download/v0.1.25/OllamaSetup.exe

[rezonant]

For me the file listed on the Github README identifies as Trojan:Win32/Sabsik.FL.A!ml on Windows Defender (Windows 11).

Uploading that to VirusTotal yields no flags: https://www.virustotal.com/gui/file/80f7cb53c6ddba62076bcffabf926e070bec78587ee4a927208165f8afe9afce

I scanned your updated installer and it does not flag Windows Defender for me, but I did upload it to VirusTotal as well and it did hit a flag on Microsoft's AV for Trojan:Win32/Wacatac.B!ml as originally reported.

https://www.virustotal.com/gui/file/68157bfc0a9385a0aaf809e6621a6d6de5219a8444b22573ce483269fc25fe1d/details

[Leonai-do]

Kaspersky also detect some files with trojans

[dhiltgen]

Thanks for checking!

So it sounds like those two removals didn't resolve the problem. Another plausible cause is the way we carry payloads inside the primary executable, which isn't strictly necessary on windows now, so I'll start exploring a change to carry everything as installer payloads and no nesting inside the ollama binary.

[dhiltgen]

I've tried various permutations and our setup installer always triggers the Microsoft AV in virtustotal. The underlying ollama.exe shows clean with or without the nested payloads. Maybe Microsoft just doesn't trust our cert yet.

[rezonant]

Sources online say this is common and that having a cert doesn't guarantee you aren't flagged. You need to run your releases through something like VirusTotal to identify any flags, and then submit your executable in a whitelist request to the vendors that flag it. Microsoft has a form for that, for one. After awhile you won't be flagged as your reputation grows. Good luck.

[fristhon]

Some useful insights and the form that @rezonant is talking about can be found here https://learn.microsoft.com/en-us/microsoft-365/security/defender/criteria

[dhiltgen]

We've submitted a ticket to Microsoft so hopefully that will work through the system before we cut our next release and fix the false positives.

[jmorganca]

Hi all, wanted to post an update. As mentioned by @dhiltgen, we've contacted Microsoft to resolve this false-positive issue. It is common with Go projects (see https://go.dev/doc/faq#virus) and has affected similar projects such as Docker for Windows.

While we work on fixing this with Microsoft (we are in contact with their Security Intelligence team), you can fix the false-positive warning by updating your Windows Defender Virus Definitions:

• Open Virus & threat protection in the Windows Security application
• Click on Protection updates under Virus & threat protection updates:
• Click Check for updates

[David-Woodthorpe]

I also just had a trojan warning with Microsoft Defender when trying to update ollama - all virus definitions are up to date

[OMGnotThatGuy]

Security intelligence version: 1.405.380.0 still alerts false positive.

[solitaryurt]

I also just had a trojan warning with Microsoft Defender when trying to update ollama - all virus definitions are up to date

Same with v0.1.26

[internetscooter]

Security intelligence version: 1.405.391.0 still alerts false positive.

Different alert though?

Trojan:Script/Sabsik.FL.A!ml

[solitaryurt]

Security intelligence version: 1.405.391.0 still alerts false positive.

Different alert though?

Trojan:Script/Sabsik.FL.A!ml

These false positives are very common with Windows Golang binaries unfortunately.

[ewebgh33]

Soooo does it run despite the flag and the file getting quarantined?

For me it's also Trojan:Win32/Wacatac.B!ml

[Lunarisnia]

Happened when trying to update

Right now downgrading to 0.1.25 seems to be my only option for it to not be flagged

[ewebgh33]

I tried starting Ollama anyway. It started. BUT

When I start Ollama using WIndows Powershell, is it running the windows one or the WSL one? I would have thought Windows version, because surely only the Ubuntu prompt would start the WSL one.

Bear with me here - the reason I can't tell if it's Windows is: 1. For ollama run llama2 it starts up pretty quick - it didn't seem to download. So is it running the model file I already downloaded for WSL?

I thought the Windows version would have it's models in the users home folder? I looked, and C:\Users\COMPUTERFACE.ollama has no models in it. So IS it using the WSL models? (If I download a new model, where will it go? WSL folder or windows version folder?)

Also - there's no Ollama icon in the system tray like the video said there would be for the windows version. So how do I tell if Win version is running?

Maybe this is a dumb question, but given the ambiguities I've listed I am confused.

[nagkumar]

Upon an update to this version, virus alert is shown

[shiro-videXX]

When trying to update to the newest version (v0.1.26), Windows Defender also flagged this as a threat for me on Windows 10.

Interestingly, ollama seems to be version 0.1.26 according to version info and it seems to run commands normally.

[edit] I'm not sure what part of ollama usually runs in the background, but that seems to have been killed by Windows Defender. I'll reinstall v0.1.25 for now since the newest still seems to get flagged.

[schergr]

I received the same. Let me know if you need any logs.

[dasjet]

Ollama 0.1.26.0 Kaspersky warning

[davidlehub]

same for me on windows 11. Not sure if it's really safe to "allow" it to run

[Alias4D]

[MisterAG]

Exact same error message as Alias4D above on my Win11 box, latest virus updates.

[metathron]

I got the same Trojan warning

[jmorganca]

Hi folks, we're almost done resolving this with Microsoft. 2/3 of the binaries included with Ollama no longer seem to be triggering false alarms, one more to go and we have an ongoing ticket with Microsoft for it.

Thanks for your patience and I'm so sorry for the alert.