AVG claims bitcoin is malware | Bitcointalksearch.org

JuanPabloCuervo

full member

Activity: 246

Merit: 102

http://www.av-comparatives.org/

i only trust Avira, Malwarebytes.org & System Restore.

i had a virus that no other could eliminate, norton, kapersky, etc...

it was a virus a few years back, that eats the cpu doing nothing...
it killed some laptops with bad cooling, compaq 3000

i though it was a virus designed to kill pcs, but now i know what it really was doing... Grin

The00Dustin

hero member

Activity: 807

Merit: 500

Quote from: syb3ria on July 20, 2011, 06:19:40 AM

Quote from: The00Dustin on July 18, 2011, 05:17:45 PM

Quote from: syb3ria on July 18, 2011, 04:54:59 PM

Kaspersky Virus Removal Tool detects latest poclbm.exe as destructive tool. Have that in mind when running a scan.

In the meantime, couldn't you do us all a favor and report it as a false positive?

Couldn't find report option, it's just a cleaning tool.

For the record, I SUCK at searching. That said, ONE search with YAHOO:
http://search.yahoo.com/search;_ylt=AsGZb8flldWyGZiwxiMxilWbvZx4?p=kapersky+false+positive+report&toggle=1&cop=mss&ei=UTF-8&fr=yfp-t-374
The FIRST result lead me here:
http://forum.kaspersky.com/index.php?showtopic=13881
That KAPERSKY GLOBAL MODEATOR'S post lead me here:
http://support.kaspersky.com/virlab/helpdesk.html
That submission form that allows for attached files has a drop down that includes 'False alarm on a file' and 'False alarm on a web resource'.

No offense to you, but seriously, where where exactly did you look for a report option? In the scanner itself? (That would be the most logical and understandable explanation for not finding one, but I've never seen an option to report a false positive within an AV program)

Also for the record, emphasized words are to show just how simple this was to find (it was about 10 times easier than I expected, especially since Yahoo and Google are far from the same when it comes to search results).

syb3ria

newbie

Activity: 55

Merit: 0

Quote from: The00Dustin on July 18, 2011, 05:17:45 PM

Quote from: syb3ria on July 18, 2011, 04:54:59 PM

Kaspersky Virus Removal Tool detects latest poclbm.exe as destructive tool. Have that in mind when running a scan.

In the meantime, couldn't you do us all a favor and report it as a false positive?

Couldn't find report option, it's just a cleaning tool.

The00Dustin

hero member

Activity: 807

Merit: 500

I had ufasoft miner reported as a "trojan (generic)" (IOW heuristics probably) by sunbelt and reported it as a false positive. It is now a potentially unwanted program with them, which is fine, so are lots of other useful tools (including syslog servers and tftp servers). I realize free programs might not have instant or great support, but we need to submit these files and note that they are false positives so that signatures can be put in place to recognize them as what they are. Regarding them being submitted for analysis, this shouldn't lead to them being marked as something they aren't, that isn't very thorough analysis, but if most detections are heuristic, then a signature that says it's potentially unwanted is certainly preferred to a guess at what baddie it is.

nmat

hero member

Activity: 602

Merit: 502

Quote from: casascius on June 28, 2011, 01:22:01 AM

THis probably happens because botnets are probably distributing bitcoin in order to mine on zombie computers... and as a few people find the intrusion and send the unwanted files they found on their machine to AV labs for analysis, it results in bitcoin executables being flagged as malware.

This is scary and definitely doesn't help bitcoin a bit...

The00Dustin

hero member

Activity: 807

Merit: 500

Quote from: syb3ria on July 18, 2011, 04:54:59 PM

Kaspersky Virus Removal Tool detects latest poclbm.exe as destructive tool. Have that in mind when running a scan.

In the meantime, couldn't you do us all a favor and report it as a false positive?

damon1492

newbie

Activity: 31

Merit: 0

Quote from: nvmind on June 27, 2011, 08:02:48 PM

Why is AVG antivirus claiming bitcoin is malware and deleting from my pc?

Same for me just started detecting it as an malware WTF!!!

syb3ria

newbie

Activity: 55

Merit: 0

Kaspersky Virus Removal Tool detects latest poclbm.exe as destructive tool. Have that in mind when running a scan.

geckogroove

newbie

Activity: 28

Merit: 0

avira detects guiminer for me but not bitcoin, its either a false positive or a warning not a detection

bitnotifications

newbie

Activity: 9

Merit: 0

The screenshot looks like the program decided based on heuristics. It detected P2P activity for example. This is probably not a manual black-listing action but an automatic heuristic.

bitcoinemily

newbie

Activity: 6

Merit: 0

AVG protects you from everything that isn't consumer mainstream. Carry on citizen Embarrassed

ping32

newbie

Activity: 1

Merit: 0

Quote from: casascius on June 28, 2011, 01:22:38 AM

Quote from: lateminer on June 28, 2011, 12:24:00 AM

AVG also detects your cracks and keygens for your pirated software, whats new?

That's because cracks and keygens are trojans, more often than not.

They do it on purpose. I read once the article from antivirus company where they mentioned they remove certain keygens, because they target the other software that company sells. Makes sense. And if they protect themselves that way, they could protect others too, if some other company will ask nicely.

repentance

hero member

Activity: 868

Merit: 1000

I'm aware of someone who unexpectedly found bitc.exe *32 on their computer today and has submitted it to the major AV companies for analysis.

The00Dustin

hero member

Activity: 807

Merit: 500

Quote from: schickel on July 18, 2011, 02:26:19 AM

I also had a flag from AVG. This, though, was a flag for a PUP (Potentially Unwanted Program) raised on UfaSoft's bitcoin-miner.exe. I'm assuming this was becuase of distribution by trojans dropping the miner on PCs to generate hashes for the distributer....

And because a corporation might not want its employees using their resources for mining...

schickel

newbie

Activity: 8

Merit: 0

I also had a flag from AVG. This, though, was a flag for a PUP (Potentially Unwanted Program) raised on UfaSoft's bitcoin-miner.exe. I'm assuming this was becuase of distribution by trojans dropping the miner on PCs to generate hashes for the distributer....

syb3ria

newbie

Activity: 55

Merit: 0

I don't know about AVG, but you may check the miner with http://www.virustotal.com/. Last time i checked, all the AV/malware scanners said it's clear Wink

JoelKatz

legendary

Activity: 1596

Merit: 1012

Democracy is vulnerable to a 51% attack.

This is heuristic detection based on the code doing a number of things AVG considers suspicious. For one thing, it's receiving a lot of network connections on a port unknown to AVG. The thing that puzzles me though is AVG says it's injecting code. There are a number of legitimate reasons it might do that, but I can't figure out from the source why it would be doing that.

Those not having problems may have heuristic detection off or may have the threshold set higher. Heuristic detection will have a lot of false positives.

hsf_context

member

Activity: 67

Merit: 10

Using AVG and so far no problems with Bitcoins.

BCwinning

hero member

Activity: 770

Merit: 500

my exe wasn't the rc1, shouldn't matter it's a trusted site.

nvmind

newbie

Activity: 17

Merit: 0

Quote from: BCwinning on June 28, 2011, 02:48:41 AM

I ran avg on a win7 box and it didn't flag bitcoin.
Where did you download your source from?

http://transact.dl.sourceforge.net/project/bitcoin/Bitcoin/bitcoin-0.3.23/test/bitcoin-0.3.23rc1-win32-setup.exe

Topic: AVG claims bitcoin is malware (Read 5666 times)