Bitcoin Forum

I just tried downloading Bitcoin Core from bitcoin.org (the link on the top of this site). My antivirus software suggested it was unsafe and removed it. I then downloaded Bitcoin Core version 0.13.1 which downloaded fine and was classified as safe when scanned with antivirus software. (I looked on virustotal.com and found that none of the FREE antivirus service have suggested that it has a virus or is a dangerous file).

This may just be that the bitcoin core has only recently been released today (the 0.13.2 version).

Verify the binaries and you will be fine. AV's tend to flag Bitcoin Core as a trojan because it looks for a wallet.dat file.

Ok, thanks. There seemed to also be a problem with deleting the installation file so I'll try to override the antivirus instead and install it that way. Once it's installed, it'll probably just work fine (I'll wait for syncronisation with the network first as I changed the drive that I installed the 0.13.1 client on).

It seems that the filesizes and SHA256 checksums of bitcoin-qt.exe are different of bitcoin-0.13.2-win64-setup.exe and bitcoin-0.13.2-win64.zip Windows 64 installers.
Virus Total gives also different reports. The bitcoin-qt.exe inside bitcoin-0.13.2-win64-setup.exe gives https://www.virustotal.com/nl/file/e676a1177a02a88a2ae504fd8649e8407c4b688aa4c340dc64d52942c251b8dd/analysis/1483648927/ which includes 3 types of COIN-STEALERS Trojans, while the bitcoin-qt.exe file inside bitcoin-0.13.2-win64.zip gives a fairly harmless https://www.virustotal.com/nl/file/ef8aa30e3efbd39eac489a5fe4481284221af4ef6e2e853cf52c31dc53813d23/analysis/1483866680/ report with NO trojans.

How is this possible ? How is it possible that there are different .EXE file sizes for the SAME client version ??

Hey,
Bitcoin Core 13.2 is brand new.  Less than a week old.  So, anti-virus software doesn't know what to do with it yet, so it deletes it.

Maybe in your case, it was Norton 360 or security suite.  It doesn't say it is a virus.  It says it may be unsafe and deletes it.  You can restore it and install.

Or, if you want to wait for Norton to figure out what's up, you can simply install 13.1 since Norton has figured out it's ok.

As has been explained multiple times, the reason AVs detect trojans is because Bitcoin Core looks for a wallet.dat file. This is a false positive. So long as the hashes of the files that you download match the signed hashes, everything is fine.

The exes are different because one is code signed and the other is not. The code signing process happens on the setup file and that effects the contents of the file, so that extracted exe file is slightly different due to the code signing.

Thank you very much for this valuable reply.