Quote from: Thunderhead on May 31, 2016, 06:54:40 PM

Is your AV the paid version ? I'm on bullguard for 5 years now , no detection on my side.

Yes, Kaspersky "total security". It's usually pretty good, but not infallible of course.

When I first started using TEK (couple of years ago?), Kaspersky was flagging it. Nobody offered any explanations on the forums at the time, and the most common advice was "turn off your AV, it's a false positive". That may well have been true but no evidence was presented. Anyway, Noise23 eventually made a change to the code and the issue went away (yea!). This latest development is more specific (trojan.msil.coinstealer.hv), but might (or might not) be a false positive.

I wish I had more details to offer, but that's all I know so far. Oh - did I mention Kaspersky would let it go for days on end before suddenly and aggressively shutting it down? I can think of a few possibilities to explain that: perhaps Kaspersky is just sloppy and notices behaviours at random times; perhaps the wallet client changes behaviour in some way that triggers an alert; perhaps Kaspersky changes its reaction to the wallet client as a result of one of its frequent database updates. That last one seems least likely, and yet - Kaspersky just started to identify the alleged trojan by name today.

Murky stuff. I hope it's no big deal, these PoS coin wallets are fun. Maybe Noise23 will save the day again. Wink