Malware detected from ESET Antivirus

[mack0196]

Malware scanning found a trojan in wakatime extension files and disabled the extension.

Real-time file system protection;file;C:\Users\XXX\.wakatime\wakatime-cli-windows-amd64.exe;a variant of WinGo/Agent_AGen.AN trojan;cleaned by deleting;

Event occurred during an attempt to run the file by the application: C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\IDE\devenv.exe

Could a security audit be performed to verify and clean if found?

[alanhamlett]

This started happening after we upgraded Go in the wakatime-cli part of the extension. I used this guide to report the false positive to Trend Micro.

[mack0196]

Thanks. I originally said trend micro but we are using eset. Have you filed similar report https://support.eset.com/en/kb141-submit-a-virus-website-or-potential-false-positive-sample-to-the-eset-lab?

[alanhamlett]

Thanks. I originally said trend micro but we are using eset. Have you filed similar report https://support.eset.com/en/kb141-submit-a-virus-website-or-potential-false-positive-sample-to-the-eset-lab?

I also sent it to ESET and received this response:

Hello,

Thank you for your submission.
It was a false positive which was fixed yesterday.

Regards,

ESET Malware Response Team

[PaltryProgrammer]

[alanhamlett]

It's not showing up as blocked on any major av providers:
https://www.virustotal.com/gui/file/5f308842c8da2cb7c4de041df545327bb493d5d9d9779ceec1351e5a8082869d

As long as you haven't disabled SSL in your ~/.wakatime.cfg then it's safe. Just click More Options and allow it.