xmrig / xmrig-amd

Monero AMD (OpenCL) miner
GNU General Public License v3.0
415 stars 228 forks source link

Trojan found - according to windows defender #23

Closed vmajor closed 6 years ago

vmajor commented 6 years ago

Windows defender reports a trojan in v2.4.3-beta2

alexcom commented 6 years ago

A lot of AV software recognize miners as viruses. Sometimes because they are packed binaries( if closed source) and sometimes just because many companies use their software installers to install a miner that will hog your CPU power for their benefit. It's a right thing for AV software to report about miners. Their classification of miners as Trojans is not correct of course but there's nothing we can do about it. Download sources, review them and build miner yourself if you in doubt about binaries.

semtex41 commented 6 years ago

Trojan:Win32/Tiggre!plock is what it is showing. That isnt the same as saying the AV is detecting it as a PUP/Hackertool.

It might be best to have one of the devs submit it officially: https://www.microsoft.com/en-us/wdsi/filesubmission

alexcom commented 6 years ago

@semtex41 You know that virus classification is a thing each AV vendor invents by themselves. They just decided to call it a trojan at MS. I've built a binary myself and submitted for scan to VirusTotal. Here's a result: link. If the link is still valid you'll see that only 14 of 61 AV programs detected it as virus. Most famous AV programs(Kaspersky, ESET) detected it correctly as miner. You'll never please each AV software engine and you never control the decision behind classification. There's no sense in wasting time trying to make AV vendor to update software just to identify xmrig correctly as miner or tool. Worth mention that MS Defender is a crappy AV software and MS itself states that Defender is not a replacement for real AV software. Therefore there's no sense in attempts to satisfy it.