Malware detected in my Copilot App

[kabanda]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Other

Discussion Details

Hi all,

I originally wanted to submit this as a support ticket, but despite following the "Submit a Ticket" links, I was unable to find a way to actually create one. I repeatedly ended up navigating between various support pages without reaching a ticket submission form. As this appears to be a serious issue, I'm posting it here in the hope that someone can advise.

Yesterday, my antivirus software detected malware associated with the GitHub Copilot application.

Detection details:

Detection: PDM:Exploit.Win32.Generic.nblk
Location: C:\Users\User\AppData...\GitHub Copilot\GitHub.exe

To rule out a corrupted installation, I completely uninstalled and reinstalled GitHub Copilot, ensuring that I downloaded it directly from GitHub.

However, as soon as I launch the application, both Microsoft Windows and Kaspersky repeatedly warn against installing or running it. If I proceed anyway, Kaspersky immediately quarantines the detected files and displays the following message:

"Malware detected, Save all save all your files, we will disinfect and you should restart the computer."

After restarting the computer, the Copilot application is no longer available because the affected files have been quarantined.

I currently have an active paid subscription but am unable to use the application due to this issue.

Can anyone explain what is happening here? Is this a known false positive, or is there a recognised compatibility issue between GitHub Copilot and Kaspersky?

I would appreciate any guidance. So far, I have only been directed towards automated support systems, and the suggestions provided do not appear to match the problem I am experiencing.

Many thanks,

Stephen

Note: If helpful, I can provide additional details such as the Copilot version, Kaspersky version, screenshots, and any relevant logs.

[adiraj66132]

Hi Stephen,

That sounds concerning, especially since the detection persists after reinstalling the application.

However, I wouldn't immediately assume it's either actual malware or a false positive based solely on the detection name. It would be worth checking whether this is a known Kaspersky detection and whether the affected executable is an authentic, digitally signed GitHub Copilot binary.

I'd recommend reporting the detection to both GitHub Support and Kaspersky, including the exact detection name and the affected file path. Until the issue is verified, I would avoid restoring quarantined files or adding exclusions to bypass the antivirus warning.

Hopefully, someone from GitHub can investigate this and clarify whether it's a false positive or a genuine security issue.

[kabanda]

Hi Adiraj,
Thank you for your response,

Yes I think the next step is to contact Kaspersky, but as I said in my email, I was unable to get any direct contact for GitHub, even an email would do but cannot obtain one so far.

Many thanks,

Stephen.

[spiritofthenight]

My recommendation: use GitHub and Copilot's web versions, not the executables. If you must use them, Then before before assuming the application is malicious, can you provide:

The SHA-256 hash of GitHub.exe , you can do it with:

Get-FileHash GitHub.exe -Algorithm SHA256

The file version of GitHub.exe.
The signer shown under Properties -> Digital Signatures.
A VirusTotal report for the file.

If the digital signature is valid and only Kaspersky detects it while other engines do not, this may be a false positive. Unfortunately, I could not find an official published SHA-256 checksum for the GitHub Copilot App executable to compare against Because Microsoft apparently dont publish the checksums !!!, so the signature information and VirusTotal results would be very helpful.