Anti AntiVirus Bitcoin Core

[nopara73]

Hi guys!  

Recently we decided to ship Bitcoin Core with Wasabi Wallet. However this resulted in an unpleasant surprise, where numerous anti-virus companies started flagging Wasabi due to Bitcoin Core is being flagged too.  
We tried to contact these companies but generally they don't seem to care about it.  

So, the last thing we could do is call for the community to help us reporting the false positive results. You can check which anti viruses are flagging Bitcoin Core by uploading Bitcoin Core binaries https://bitcoincore.org/en/download/  to a website like VirusTotal https://www.virustotal.com/.

In order to make this process smoother, we collected contact information and wrote an email template: https://bit.ly/helpbitcoin

Let's anti anti-virus Bitcoin Core together  

[shield132]

The most curious thing that I found there is that John McAfee is the founder of antivirus company McAfee LLC and at the same time this person is actively in bitcoin with his silly statements and false promises (everyone knows one of them).
I can't check right now but did McAfee determined that as a virus? If yes, then I'm more curious to see response from them on your email regarding to false positive.

[Soratrade]

The most curious thing that I found there is that John McAfee is the founder of antivirus company McAfee LLC and at the same time this person is actively in bitcoin with his silly statements and false promises (everyone knows one of them).
I can't check right now but did McAfee determined that as a virus? If yes, then I'm more curious to see response from them on your email regarding to false positive.

John has nothing to do with his old company anymore, he does not even like them anymore.

[BitcoinFX]

Great ongoing initiative for the community to support! ...

...snip...

Sometimes, nothing ever changes but the shoes ...

Win32 CPU Cycles vs 'Live Protection' Engines ?
- https://bitcointalk.org/index.php?topic=35.0

...

"Important!
Bitcoin Core is detected by many of the major antivirus as malware.
Join us in reporting it as a false positive.
Thank you @wasabiwallet for taking care of this."
- https://twitter.com/mir_btc/status/1213096157167136773

"Happy Birthday #Bitcoin and happy #ProofOfKeys day!

BUT REMEMBER 👇

#BitcoinCore is detected since years by some antiviruses, despite it being one of the most (if not the most) highly scrutinized and maintained open source software in existence.

HELP 👉 http://bit.ly/helpbitcoin "

- https://twitter.com/RiccardoMasutti/status/1213068495400951809

- https://youtu.be/IP3XaAqDwZ0

 

[bL4nkcode]

Most desktop wallet are detected as malware on any or all anti virus except if you manually exclude it.

And yeah, nice initiative for the community.

[gmaxwell]

Let's anti anti-virus Bitcoin Core together 

In addition to doing this, I think it would be useful to attempt to circumvent the AV... since the listing is mostly lazyness they probably won't try to actively work against some simple countermeasures.

Some stuff before indicated that some were simply triggering on the string "wallet.dat" and others on some mining function function names. It would be pretty non-intrusive to mildly obfscuate them in the binary (e.g. renaming the function and just xoring wallet.dat with something or similar).

That in no way replaces reports-- it compliments them. If it's been heavily reported as okay, then they'll be less likely to work around some simple countermeasures.

[Wind_FURY]

Let's anti anti-virus Bitcoin Core together  

In addition to doing this, I think it would be useful to attempt to circumvent the AV...

I believe it's also an opportunity for the community to encourage the use of OSS, specifically Linux. We're giving tech-corporations power over what tools we should and shouldn't run in our computers.

since the listing is mostly lazyness they probably won't try to actively work against some simple countermeasures.

But maybe it's also "something else". Tin foil hats on.

[NotATether]

Remember that the reason AV companies flag bitcoin wallets is because they can't (or maybe don't want to) tell the different between an actual wallet and a desktop cryptominer. If it did quarantine the wallet program just whitelist it, the AV won't pester you anymore.

[kzv]

Remember that the reason AV companies flag bitcoin wallets is because they can't (or maybe don't want to) tell the different between an actual wallet and a desktop cryptominer. If it did quarantine the wallet program just whitelist it, the AV won't pester you anymore.

For this reason, a few years ago, antiviruses often flagged new versions Bitcoin Core or it forks
But as I know the miner functionality is cut from source code Bitcoin Core since v.0.13

[Luke-Jr]

Remember that the reason AV companies flag bitcoin wallets is because they can't (or maybe don't want to) tell the different between an actual wallet and a desktop cryptominer. If it did quarantine the wallet program just whitelist it, the AV won't pester you anymore.

Mining software isn't malware either, though.

In fact, I would suggest someone put together a list of affected projects (BFGMiner has had this problem for years) for reporting as safe...

[nopara73]

To provide some update here, the project has limited success. For example there is a tweet from coinforensics[0] with a positive response attached. Yet, I noticed a new detection emerged[1] within a 4 days time period, which is just strange.
To further pursue the issue one of our software developer, Lucas Ontivero will try to tackle the antiviruses with pull requests from February 15, as it will be apparent by that time how successful the reporting campaign was.

- 0 https://twitter.com/coinforensics/status/1216430197085495297)
- 1 https://imgur.com/a/rGCLkph

[lontivero]

In order to check whether the AVs search for the string wallet.dat or not, I compiled bitcoin (latest master branch) and uploaded the bitcoind file to VirusTotal. After that I replaced the string by "monedero.txt" everywhere and verified the compiled file doesn't contain "wallet.dat" anywhere then I uploaded that new version to VirusTotal again with exact same result:

    "wallet.dat": https://www.virustotal.com/gui/file/874b5bf081724342a03e2f65823869e991273f9fa9fc6011498553a821dee846/detection

    "monedero.txt": https://www.virustotal.com/gui/file/a8f4fd57504580d7015f38fce7a32dcd2d1a36482a98a2998741ebfe7ba7a82c/detection

It has to be a combination of mining functions by sure what makes the AV believe that it is program designed to use the user's computer resources to mine cryptocurrencies.

[nopara73]

There's also an unsatisfactory reason that's been recently received, which has no counter: "it's making multiple connections to multiple IPs" https://twitter.com/coinforensics/status/1219728491891101697

[StonerStanley]

Just uninstall the Anti virus application that is in your computer that will solve it. I haven't been using an AV for many years because their redundant and has lots of issues such as adware, take to much memory in your ram, deletes file unknowingly and serve as a spyware to mine data.

Try Comodo Internet Security and turn off the antivirus. It's probably one of the best security software for windows.

[LFC_Bitcoin]

I use my computer solely for Bitcoin Core, literally nothing else. I deactivated all anti-virus software on my computer so I obviously don’t have a problem. I can imagine it being frustrating if your AV software keeps flagging Bitcoin Core as potential malware.

Can I just advise everybody to please refrain from storing a significant amount of BTC on any device they use for everyday, regular browsing & downloading files.

I’ve seen too many horror stories here from idiots downloading movies & torrents to a computer storing a significant amount of coin, only for said movies & torrents to end up being bitcoin stealing malware.

Use your head & look after your coin.

[coinforensics]

I have been monitoring Bitcoin Core versions in the past few months and reported the false positives to the AV providers..

To better track the status I created the "Bitcoin Client VirusTotal Tracker" on https://bitcoinissafe.com.
It checks the false positive detection rate of Bitcoin clients every few hours via the VirusTotal API.

I appreciate all feedback, improvements, changes, ..

[Casdinyard]

Recently we decided to ship Bitcoin Core with Wasabi Wallet. However this resulted in an unpleasant surprise, where numerous anti-virus companies started flagging Wasabi due to Bitcoin Core is being flagged too.  

AFAIK BitcoinCore was flagged due to the fact that some applications uses some computer's graphic cards for mining, such as the issue of LoL back then where someone detected a mining code running in background of League of Legends. Hence, anti-virus blocks any applications that has something to do with mining cryptocurrency even the BitcoinCore itself.

I'm not that tech savvy but I only see such possibility in this case. But what operating system are you using? If that would be Windows distros, then it is not that kind of unusual case as its pre-installed Windows Defender flags anything suspicious as virus, as long as it wasn't their product or an open-source product.

[coinforensics]

You might want to add Electrum, since there are few people said Electrum is flagged by their antivirus.

Thanks for the feedback.

Added the Windows and macOS binaries.

[yazher]

Sometimes I downloaded some files that automatically deleted by my anti-virus even though it's nothing to do with my security or whatever. It's fine for me because I can simply exclude the files whenever I want to use it again. But we are talking about Bitcoin core here and this is some serious matter, you know what? what if you finally synchronized all the nodes needed and when you update your anti-virus and when it finally has done, it automatically deletes the bitcoin core? because of their new updates.

[Casdinyard]

1. Mining functionally removed from Bitcoin long time ago
2. Bitcoin Core is open-source software

Then I guess that nowadays, most anti-virus software doesn't include Bitcoin core and anything related to cryptocurrency to their whitelist, maybe due to some factors such as it can be used by some who would make their own code with it's system to have a suspicious script injected onto it, and also there are a lot of opportunities for the hackers to use anything crypto-related such as wallets to gain access to their targets.

Though it was an open-source software, it's also a vulnerability as scripts can be easily added to such programs and they might make their own torrent server to be downloaded out of it. But still, a lot of AVs still hasn't whitelisted each and every programs made and updated everyday, and even some AVs is just a fraud making their own viruses and a version of past detected viruses.