Avast quarantined Bitcoin-QT.exe 0.13.0 binary

Viruses and worms
1

I just upgraded to Bitcoin-QT 0.13.0 on Windows 7 64 bit.
Before anyone asks, yes I verified the download signature against the SHA256SUMS.asc file, whose signature correctly matched that of Wladimir J. van der Laan’s PGP key (that I downloaded long ago, before the recent threat announcement).

When I tried to run it for the first time, Avast did a deep scan and quarantined the binary.
Is anyone else having this issue or found a solution?
Could a file that passed signature verification still have an infection?! Is this a false positive?

Avast 12.3.2280 (build 12.3.3154.0)
Definitions 160824-0

2

Test the file at VT (https://www.virustotal.com) and post the link to the result here.

3
Could a file that passed signature verification still have an infection?!
Yes it sure can. The verification only says that it is the file as you should have. It doesn't say anything about what the file is (not) doing.
4

https://www.virustotal.com/en/file/1174cf33f9d341032413225ce2ff933b6baea10e4a8ebfef1e79ca2034669004/analysis/

It looks good there, but Avast DeepScreen quarantines it.

Also, I’ve managed to successfully verify that the binary matches the published checksums and PGP signatures, so this now looks like a false positive (or else Bitcoin Core is compromised). :wink:

5

what malware name does avast give when quarantine it?

How to report FP > https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

6

None. It’s DeepScreen.

7

Hello,
post the screenshot of detection, please. Detection name can be also seen in avast’s virus chest.

Milos

8

It just says “blocked a threat” and “Moved to chest”.

9

Wait, in the “properties” in the chest, I can see: Dyna:BitCoinMiner-CR [PUP]||mul

10

I have this exact same issue with Bitcoin Core 0.14.0 any ideas if this is a concern or a false positive? any help appreciated.

I have had the program installed for some time but only installed Avast today

I have uploaded to VirusTotal and it found no issues, 0/62 scans

11

Hello,
post the VirusTotal link, please.

Milos