Go Code Hangs Before Running : Antimalware Service Executable Spike

[connor-ve]

Go version

go1.21.4 windows/amd64

Output of go env in your module/workspace:

set GO111MODULE=
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\{user}\AppData\Local\go-build
set GOENV=C:\Users\{user}\AppData\Roaming\go\env
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\{user}\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=C:\Users\{user}\go
set GOPRIVATE=
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=C:\Program Files\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLCHAIN=auto
set GOTOOLDIR=C:\Program Files\Go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.21.4
set GCCGO=gccgo
set GOAMD64=v1
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=C:\Users\{user}\go.mod
set GOWORK=
set CGO_CFLAGS=-O2 -g
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-O2 -g
set CGO_FFLAGS=-O2 -g
set CGO_LDFLAGS=-O2 -g
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=C:\Users\{user}\AppData\Local\Temp\go-build3515438170=/tmp/go-build -gno-record-gcc-switches

What did you do?

To reproduce my error locally, all I need to do is run a go file using the command go run { file name }, and I will see a huge usage spike by my Antimalware executable on cpu usage. Then My code will proceed to "hang up" either before running or before exiting. Generally speaking after running for 30-40 second my code will complete running.

What did you see happen?

For my environment I am running Windows 10 along with Windows Defender. Note I have not touched defender's settings since I got my laptop. Within the last month or so, I have noticed when I try to run my Go projects using the go run commands there is a long delay before my code actually runs and sometimes there is a long delay after the output of my code but it hasn't fully ended yet. In my code there are no go routines defined and I am working with fairly basic synchronous files and I have tested this with fairly small files. It is not consist with smaller go projects, (aka hello worlds), but with a a larger project it is every time. The big issue that I see is when I run my go command Antimalware Service Executable task will take up roughly 70% or more of my CPU. This causes my computer to freeze constantly and has been greatly hindered my progress. I have since tried to exclude the folder for my go projects from Windows Defender as this executable is specific to it, but I am still noticing the spike.

What did you expect to see?

I expected my code to run fairly fast, and not to see a spike in the usage of my windows defender. All in all, I believe my code is getting flagged as malware but I am unsure how to fix this.

[gabyhelp]

Related Issues

• v1.21 compile.exe reported as a Thread by WindowsDefender #61937 (closed)
• runtime: hangs on windows with golang >= 1.14 #48059
• windows 10 go executables as Troj.Win32.TRX.XXPE50FFF042 #45191 (closed)
• runtime: hangs on Windows due to McAfee's mfehcinj.dll apparently hijacking or suspending threads #42528 (closed)
• affected/package: Performance issue with VScode using Golang (go1.17.7 windows/amd64) #51402 (closed)
• Go Hello World Program taking too long to run #40374 (closed)
• cmd/go: cache results of exec.LookPath #36768 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[ALTree]

Thanks for the report. Unfortunately...

All in all, I believe my code is getting flagged as malware but I am unsure how to fix this.

All you can do is report the issue to your antivirus vendor. This is not an issue in Go, so I'm closing here.

[laurentcau]

My company controls the windows defender settings, so I can't add exception on go.exe.
I see go.exe is not signed.
I guess the anti-malware protection is more suspicious on such executable and make deeper search.
Could you try to sign installed binaries? (I think it's a good security practice in general.)