lf detected as virus by Windows Defender

[GeorgeManukyan]

When attempting to use the lf(r33) file manager on Windows, Windows Defender detects the application as a virus and automatically deletes it.

https://www.virustotal.com/gui/file/0ad4cbeca10a8d8356f46fcba7482f99d2a0d1fe5a27096237b28761aaa5bd34

Maybe LF could be submitted to antivirus companies for review and request to have it excluded from virus definitions.

[joelim-work]

This has been brought up a few times before:

• Panic: the parameter is incorrect #479
• Windows r24 Virustotal warnings #695
• Windows r31 VirusTotal and CylanceProtect Warning  #1622

I suspect this is happening because lf is a power-user tool that can do powerful things like executing shell commands, and this is being flagged due to heuristics.

I'm not a Windows user myself so I don't have much motivation here, but anyone who is interested can probably try submitting this as a false positive whenever there is a new release.

[Limero]

If I build the latest master for Windows and upload to VirusTotal, it's detected by Microsoft as Program:Win32/Wacapew.C!ml:

env GOOS=windows go build .

If I build it with debug information stripped, it doesn't get detected

env GOOS=windows go build -ldflags="-s -w" .

So it's possible we could just do this for the Windows releases and bypass antivirus checks. It will also result in smaller binaries (about 2mb smaller), so maybe we should even do the same for all releases.

Edit: I see now that we are already doing this 🤔 https://github.com/gokcehan/lf/blob/master/gen/xbuild.sh#L25

[CatsDeservePets]

I suspect this is happening because lf is a power-user tool that can do powerful things like executing shell commands, and this is being flagged due to heuristics.

In my personal experience, it somehow has to do with Golang itself. On my work PC, I regularly see false positives for our own internal tools written in Go and even for files related to the Go compiler itself.