Skip to content

CLI v1.0 triggers windows defender for Worm:Win32/Yuner.A #1894

@baywet

Description

@baywet

Describe the bug

A couple of days ago I upgraded my CLI to v1.0 using winget winget install --id GitHub.cli -e.
For reference, here is the manifest it installed.

After digging around, I found that windows defender had quarantined gh.exe because it detected it contained Yuner.A

OS: windows 10 2004 (19041.508)
Rules updates (for defender): 1.323.1687.0

As a workaround I added the CLI as an exclusion for the time being.

Steps to reproduce the behavior

  1. install GH CLI on a similar OS configuration
  2. reboot
  3. gh.exe will be quarantined

Expected vs actual behavior

The CLI not to trigger the antivirus.

Logs

Using PowerShell 7 to call gh, I obtained the following error response.

ResourceUnavailable: Program 'gh.exe' failed to run: Operation did not complete successfully because the file contains a virus or potentially unwanted software.At line:1 char:1

Using cmd to call GitHub I obtained the following response.

The system cannot access the following resource.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions