Coordinating anti virus false positive reporting #17779

issue MaxHillebrand opened this issue on December 20, 2019
  1. MaxHillebrand commented at 10:29 AM on December 20, 2019: none

    Current Problem

    As reported several times [#4069 #11852 #12320 #12777 #15156], Bitcoin Core binaries [including v0.19 Win .exe, Linux .tar.gz, OSX .dmg] are flagged as potentially unwanted program by several anti virus programs. This is confusing for users, and might deter them from running a full node.

    There have already been several attempts [#6613 #6650 #16721] to obfuscate database so to not get flagged, but this has so far not solved the problem entirely.

    As I read in the above mentioned issues, this might not really be of concern to this repository, so my issue might be misplaced, if that is the case please close it.

    Proposed Solution I am unsure about the best approach to solving this issue, thus I open this issue to discuss and coordinate. My idea is to contact the companies and developers of these anti virus programs and reporting the false positive flag, with the request to fix the wrong analysis for these binaries. This seems to be the proper way of requesting a whitelist.

    If this is the proper way of doing so, I have curated online forms and email addresses where such a false positive can be reported. [I will edit this issue when I find further sources.]

    ** Online Forms ** Antity, Avast, Avira, AVG, BitDefender, Gdata, eScan, Fortinet, F-Secure, Kaspersky, e-Gambit, K7 Computing, TrendMicro

    ** Emails ** removespam@fortinet.com, support@cyren.com, virus@arcabit.com, virus@avira.com, virus_submission@bitdefender.com, info@cyren.com, samples@eset.com, samples@ikarus.at, fp@escanav.com, info@fireeye.com, submitvirus@fortinet.com, support@jiangmin.com, reportfp@k7computing.com, info@maxpcsecure.com

    Here is a possible text as template for the report, it's important that the email subject line starts with the word FALSE.

    To: mailof@antivirusvendor.here
    Subject: FALSE: files being detected by {AntivirusVendorHere} - False Positive Report
    
    Body: Dear [antivirus vendor],
    I write this email to report as a false positives two different software.
    
    Unfortunately, your antivirus reports two open source and safe Bitcoin software as malware; more specifically, they are categorized as "Bitcoin Miner". This claim is extremely incorrect.
    The two software are, respectively, "Bitcoin Core" and "Wasabi Wallet".
    
    Bitcoin Core, despite being one of the most (if not the most) highly scrutinized and maintained open-source software in existence, it is categorized as "Bitcoin Miner".
    Bitcoin Core is considered to be Bitcoin's reference implementation, serves as a Bitcoin node and provides a Bitcoin wallet which fully verifies payments.
    It is not possible to mine with this software, since the mining code was removed in 2013.
    
    Wasabi Wallet is a open-source and non-custodial, Bitcoin wallet that integrates Bitcoin Core within it to validate transactions without having to connect to third party servers on the network, and for this reason, it is also reported as "Bitcoin Miner", when its only task is to allow users to manage bitcoins in a secure and user friendly way.
    Again, Wasabi Wallet cannot in any way mine bitcoins (or any other cryptocurrency), as its sole purpose is to manage bitcoins.
    
    (optional from here, edit according to your antivirus - The more information there is, the better)
    Additional information:
    Product - McAfee Security Center
    Version - v16.0
    Engine - 3181.0
    Type of alert - ELF:BitCoinMiner-ET [PUP]
    
    You can find the two files attached.
    Looking forward to your kind reply, I wish you a good job.
    
    Regards,
    Name and Surname
    

    Additional context I bring this up now because with Wasabi Wallet v1.1.10, the included bitcoind and hwi binaries are part of the reason why Wasabi is now also flagged as a potentially unwanted program.

  2. MaxHillebrand added the label Feature on Dec 20, 2019
  3. RiccardoMasutti commented at 11:07 AM on December 20, 2019: contributor

    The average user doesn't know what is the difference between a PUP (Potential Unwanted Program) and a malware, so I agree with that.

  4. fanquake commented at 2:00 PM on August 14, 2022: member

    Going to close this for now. I'm not sure there is anything more for this repository to coordinate, or that it should be happening in this issue tracker.

  5. fanquake closed this on Aug 14, 2022

  6. RiccardoMasutti commented at 9:51 PM on August 14, 2022: contributor

    Going to close this for now. I'm not sure there is anything more for this repository to coordinate, or that it should be happening in this issue tracker.

    This might interest people who will read this issue: https://bitcoinissafe.com/

  7. bitcoin locked this on Aug 14, 2023

github-metadata-mirror

This is a metadata mirror of the GitHub repository bitcoin/bitcoin. This site is not affiliated with GitHub. Content is generated from a GitHub metadata backup.
generated: 2026-04-17 03:14 UTC

This site is hosted by @0xB10C
More mirrored repositories can be found on mirror.b10c.me