# Last Daml SDK installation triggered the antivirus **URL:** \ **Category:** App Development\ **Tags:** daml, daml-sdk\ **Created:** [November 3, 2022, 10:31pm UTC](https://forum.canton.network/t/last-daml-sdk-installation-triggered-the-antivirus/5593 "2022-11-03T22:31:21Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![cohen.avraham](https://avatars.discourse-cdn.com/v4/letter/c/a87d85/32.png) [@cohen.avraham](https://forum.canton.network/u/cohen.avraham)\ **Post date:** [November 3, 2022, 10:31pm UTC](https://forum.canton.network/t/last-daml-sdk-installation-triggered-the-antivirus/5593/1 "2022-11-03T22:31:21Z")
G-d willing Hello DA Team, I downloaded the latest SDK to my laptop and when running `daml studio` my Norton Antivirus jumped indicating the following issue: ![image](https://canada1.discourse-cdn.com/flex028/uploads/daml/original/2X/e/ea083d688735ed032e6f0de7c22e58102bb01392.png) The antivirus was triggered even before this message, I just didn’t take a screenshot of it. Anything that I need to do in order for that not to happen? ---
**Author:** ![Ben\_M](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/ben_m/32/3080_2.png) [@Ben\_M](https://forum.canton.network/u/Ben_M)\ **Post date:** [November 3, 2022, 11:15pm UTC](https://forum.canton.network/t/last-daml-sdk-installation-triggered-the-antivirus/5593/2 "2022-11-03T23:15:38Z")
Hi @cohen.avraham, I am certainly _very_ rusty with WINOS but I would remove your complete Daml folder from any future active scans. Especially if you created it, work with it and are the only one what has access to it. Looking at that program path that allegedly triggered the alert, that’s your Daml EXEC, that I’d assume you put there. Try that. If it works, great else come back. ---
**Author:** ![rohitt](https://avatars.discourse-cdn.com/v4/letter/r/9d8465/32.png) [@rohitt](https://forum.canton.network/u/rohitt)\ **Post date:** [November 3, 2022, 11:42pm UTC](https://forum.canton.network/t/last-daml-sdk-installation-triggered-the-antivirus/5593/3 "2022-11-03T23:42:21Z")
Found this [link](https://support.norton.com/sp/en/au/home/current/solutions/v130571264) to remove a folder or an extension from Norton Data Protector. ---
**Author:** ![cohen.avraham](https://avatars.discourse-cdn.com/v4/letter/c/a87d85/32.png) [@cohen.avraham](https://forum.canton.network/u/cohen.avraham)\ **Post date:** [November 4, 2022, 12:24am UTC](https://forum.canton.network/t/last-daml-sdk-installation-triggered-the-antivirus/5593/4 "2022-11-04T00:24:41Z")
G-d willing Thanks @Ben_M and @rohitt, I am aware of how to remove a folder from future scans of the antivirus. However, it was surprising for me to receive this alert from the antivirus as I was not getting it when installing previous versions. I was thinking that it will be a good thing to raise this matter. ---
**Author:** ![Ben\_M](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/ben_m/32/3080_2.png) [@Ben\_M](https://forum.canton.network/u/Ben_M)\ **Post date:** [November 4, 2022, 1:03am UTC](https://forum.canton.network/t/last-daml-sdk-installation-triggered-the-antivirus/5593/5 "2022-11-04T01:03:31Z")
Thanks for being understanding 😁 I’ll flag this with the Daml Language team for due diligence. ---
**Author:** ![cohen.avraham](https://avatars.discourse-cdn.com/v4/letter/c/a87d85/32.png) [@cohen.avraham](https://forum.canton.network/u/cohen.avraham)\ **Post date:** [November 4, 2022, 1:54am UTC](https://forum.canton.network/t/last-daml-sdk-installation-triggered-the-antivirus/5593/6 "2022-11-04T01:54:33Z")
Just for reference, here is another popup that was raised by the antivirus. ![image](https://canada1.discourse-cdn.com/flex028/uploads/daml/original/2X/7/72759e2794889e9770268cd6eb5a246e84289523.png) ---
**Author:** ![stefanobaghino-da](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/stefanobaghino-da/32/7057_2.png) [@stefanobaghino-da](https://forum.canton.network/u/stefanobaghino-da)\ **Post date:** [November 4, 2022, 8:04am UTC](https://forum.canton.network/t/last-daml-sdk-installation-triggered-the-antivirus/5593/7 "2022-11-04T08:04:11Z")
The action seems to be triggered by an attempt to delete a file belonging to a VS Code extension. Can you check if by chance this popup is triggered by VS Code itself, rather then by running it with `daml studio`? ---
**Author:** ![Gary\_Verhaegen](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/gary_verhaegen/32/81_2.png) [@Gary\_Verhaegen](https://forum.canton.network/u/Gary_Verhaegen)\ **Post date:** [November 4, 2022, 9:47am UTC](https://forum.canton.network/t/last-daml-sdk-installation-triggered-the-antivirus/5593/8 "2022-11-04T09:47:51Z")
Hi @cohen.avraham, Since we’re discussing security here, it may be a good idea to put on a paranoid hat for a second. Can you post here the SHA256 of your `daml.exe`? This is most likely a false positive on Norton’s part, but it does seem worth double-checking you didn’t accidentally end up with something else masquerading as Daml. To get a SHA256 hash on Windows you can use this command: ```haskell certutil -hashfile FILENAME SHA256 ``` Can you please post the computed SHA256 for `daml.exe` and, if you still have it, the installer you downloaded? Also please clarify which version, specifically, this is happening with. ---
**Author:** ![cohen.avraham](https://avatars.discourse-cdn.com/v4/letter/c/a87d85/32.png) [@cohen.avraham](https://forum.canton.network/u/cohen.avraham)\ **Post date:** [November 7, 2022, 1:16am UTC](https://forum.canton.network/t/last-daml-sdk-installation-triggered-the-antivirus/5593/9 "2022-11-07T01:16:15Z")
G-d willing Sorry, for the late response. @stefanobaghino-da , well, it did happen when opening the VS code. I assume that something was blocked, cause it does not happen again when opening the VS code again. But I am not 100% sure this is the reason. @Gary_Verhaegen I ran the SHA256 you asked and here is the result: ```haskell SHA256 hash of daml.exe: d4f1298f0fed69cbea76d09087cab8083f4085d244b00bb57dff0c68d5900b07 CertUtil: -hashfile command completed successfully. ``` It happened on version 2.4.0, It was downloaded by running the `daml install 2.4.0` directly from my command line ---
**Author:** ![Gary\_Verhaegen](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/gary_verhaegen/32/81_2.png) [@Gary\_Verhaegen](https://forum.canton.network/u/Gary_Verhaegen)\ **Post date:** [November 7, 2022, 9:49am UTC](https://forum.canton.network/t/last-daml-sdk-installation-triggered-the-antivirus/5593/10 "2022-11-07T09:49:34Z")
> [@cohen.avraham](#): > > @Gary_Verhaegen I ran the SHA256 you asked and here is the result: That’s the expected value. Thanks for reporting!