Windows 11 Blocks Install Due to “Virus Found” #29917

1. 
   IAmAdamRest commented at 8:58 pm on April 19, 2024: none

   Is there an existing issue for this?

   • I have searched the existing issues

   Current behaviour

   Windows 11 Microsoft Defender blocks the installation of Bitcoin-Core version 27.0.0 due to a virus being found. Smartscreen also blocks the installer. I was able to get it installed by telling Microsoft Defender to ignore the “virus” but since this is the default behavior of Windows 11 now this could be an issue for new users who don’t know anything.

   Expected behaviour

   That the installer is not blocked.

   Steps to reproduce

   Download installer from Bitcoin-Core website and attempt to run it in Windows 11. Installer will run but the actual bitcoin executable will start and then immediately be stopped by Windows 11 from running.

   The exact error Windows gives is: operation did not complete successfully because file contains virus

   The virus that Windows claims to be finding is: Trojan:Script/Wacatac.B!ml

   Relevant log output

   No log is generated as the executable is blocked.

   How did you obtain Bitcoin Core

   Pre-built binaries

   What version of Bitcoin Core are you using?

   v27.0.0

   Operating system and version

   Windows 11

   Machine specifications

   No response

2. 
   iotamega commented at 9:05 pm on April 19, 2024: none

   I had the same error. Be sure to not just disable Defender temporarily to get around the issue and start Bitcoin Core, it will later turn back on and kill the process again. To fully fix the issue you will need to go inside Defender and ALWAYS IGNORE the threat notification for the time being.

   Otherwise things will start up just fine and run for a few hours before Defender freaks out and closes it down.

   I believe the source is clean from a ten thousand foot review and this is a false positive but YMMV and DYOR of course but it isn’t uncommon for false positives like this.

3. 
   hebasto commented at 9:09 pm on April 19, 2024: member

   This is false positive.

   For example, https://github.com/bitcoin/bitcoin/issues?q=is%3Aissue+windows+virus.

4. hebasto added the label Windows on Apr 19, 2024
5. 
   IAmAdamRest commented at 9:13 pm on April 19, 2024: none

   Thanks for the clarification, I added to always ignore and it started without issue.
6. IAmAdamRest closed this on Apr 19, 2024

   ---

Contributors
IAmAdamRest iotamega hebasto

Labels
Windows