Please investigate whether your files infected by virus.
Windows Defender Is not new to false positives
I removed Nim from my machine. Until I hear something official, I am not taking chances.
Just to be clear: these are false positives.
But from all these reports unfortunately I think we need to do something to alleviate the problems. It's obvious this is affecting many users.
Potential solutions:
@Keithpinson would you be reassured if you could check the SHA256 of your downloaded source code against one on the website? or if the source were public-key signed?
supply chain attacks exist, but so does cryptographic signing.
Just tried this and got the same result. This is turning into a bit of an issue.
@dfprint if you go to the Windows security window, then virus and threat protection, you can allow it from there.
I hope that this can be addressed.
The download page of the Nim's website provide you with SHA256 signature so it's easy to verify the binary.
Just tried this and got a similar result, in my case it was flagged as "Win32/Uwamson.A!ml". This is turning into a bit of an issue.
It's only an issue because anti-virus don't care that their algorithm is bad and finds more false positive than actual malware.
That said, if you truly have doubt, then you can just install Windows Subsystem Linux and use Linux binary inside WSL.
It is a big issue and extremely annoying and it turns people off of the product.
Maybe some additional docs for windows installation may help. Before installing, or even downloading exclude the various directories from scanning. These would be the download directory (reset after install), the UsersusernameAppDataLocalProgramsNim-x.x.x directory, the Usersusername.nimble, UsersusernameDocumentsNim etc.
In general, I find it elegant if a tools site tells beforehand what installs where by default and what can be changed how. Same for registry keys.
Here is another data point:
I made a GitHub Action to download nim-1.4.6_x64.zip and nim-1.6.6_x64.zip and then scan them with updated Windows Defender signatures and there was nothing found.
I then compiled a simple program and scanned it with negative results too.
This is running on Windows Server 2022.
Here is the run: https://github.com/quantimnot/nim_windows_defender/runs/6455125247
Maybe new signatures removed the false positive??
This is what I have
Nim Compiler Version 1.5.1 [Windows: amd64] Compiled at 2021-04-25 Copyright (c) 2006-2021 by Andreas Rumpf
active boot switches: -d:release PS C:Program FilesGitusrbin> gcc --version gcc.exe (MinGW-W64 x86_64-posix-seh, built by Brecht Sanders) 11.2.0
At least the situation could be documented with actions that can be taken before installing Nim. On the download page?
Open the nim.cfg file, in the ./config folder.
Edit the line that contains "cc = gcc" to "cc = vcc".