# False positive: Kaspersky / ESET NOD32 currently flagging syncthing.exe as infected
**URL:** https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081
**Category:** General
**Created:** [July 3, 2017, 3:31pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081 "2017-07-03T15:31:10Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@artemis](https://forum.syncthing.net/u/artemis)
#### Post date: [July 3, 2017, 3:31pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/1 "2017-07-03T15:31:11Z")
Since June 30, I believe, Kaspersky is flagging Syncthing as “not-a-virus”, but deletes the executable every time I try to restore and run it. Below are the exact details Kaspersky gives me.
"Deleted legal software that can be used by criminals to damage your computer or personal data not-a-virus:NetTool.Win32.TorJok.aa C:\*\*\*\*\*\*\syncthing.exe Low "
---
### Author:  [@AudriusButkevicius](https://forum.syncthing.net/u/AudriusButkevicius)
#### Post date: [July 3, 2017, 3:41pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/2 "2017-07-03T15:41:26Z")
You should report it to your AV vendor.
---
### Author:  [@artemis](https://forum.syncthing.net/u/artemis)
#### Post date: [July 3, 2017, 3:42pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/3 "2017-07-03T15:42:22Z")
Sorry, I should have said that. I have reported it to Kaspersky. I was just curious if anyone else with Kaspersky was having the same issue.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [July 3, 2017, 3:46pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/4 "2017-07-03T15:46:13Z")
I’ve heard similar.
---
### Author:  [@ProactiveServices](https://forum.syncthing.net/u/ProactiveServices)
#### Post date: [July 4, 2017, 6:17pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/5 "2017-07-04T18:17:03Z")
I reported this to Kaspersky on 1st July with ticket ID KLAN-6471820464. Other than the auto-reply I’ve had nothing back. Perhaps, with you as a paying customer, they’ll actually put some effort into resolving the problem?
---
### Author:  [@theoky](https://forum.syncthing.net/u/theoky)
#### Post date: [July 10, 2017, 1:20pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/6 "2017-07-10T13:20:47Z")
I’m still encountering the same behavior with Kaspersky Endpoint Security 10 for Windows.
I’ve reported it today as well but this can take time, obviously.
My workaround currently is to downgrade to syncthing version 0.14.29 (with the file syncthing-windows-amd64-v0.14.29.zip). This version is not removed by Kaspersky (as of now), v.30, .31, and .32rc2 are removed.
I hope Kaspersky doesn’t add v.29 to their signature database…
---
### Author:  [@x2z](https://forum.syncthing.net/u/x2z)
#### Post date: [July 11, 2017, 1:12pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/7 "2017-07-11T13:12:30Z")
Sadly the same thing with ESET Endpoint Antivirus. 0.14.29 works fine, updating to 0.14.32 fails because antivirus recognizes it as a troyan.
---
### Author:  [@ProactiveServices](https://forum.syncthing.net/u/ProactiveServices)
#### Post date: [July 11, 2017, 1:31pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/8 "2017-07-11T13:31:20Z")
Eset have confirmed both the 32- and 64-bit Windows builds of 0.14.32 will no longer be detected in the next release of their detection engine.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [July 11, 2017, 2:05pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/9 "2017-07-11T14:05:10Z")
I wonder if it’s something stupid like more malware being written in Go and their signatures actually triggering on parts of the runtime, or something like that.
---
### Author:  [@thrnz](https://forum.syncthing.net/u/thrnz)
#### Post date: [July 11, 2017, 2:08pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/10 "2017-07-11T14:08:57Z")
Just a heads up. Nod32 has been flagging the Windows x64 build of syncthing.exe (v0.14.32-rc.2) as an infection for the past 36 hours or so. It’s reporting it as ‘a variant of Generik.BVOAMLP trojan’. I’ve just sent off a false positive report to [samples@eset.com](mailto:samples@eset.com), so hopefully they will investigate and fix their definitions soon.
As this isn’t a bug a such, I thought it best to let you guys know here rather than on GitHub.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [July 2, 2017, 5:18am UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/11 "2017-07-02T05:18:50Z")
Thanks, that was the right thing.
---
### Author:  [@thrnz](https://forum.syncthing.net/u/thrnz)
#### Post date: [July 2, 2017, 10:00pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/12 "2017-07-02T22:00:20Z")
It looks like they’ve fixed it in their latest definitions as its no longer being flagged as infected.
---
### Author:  [@fraternl](https://forum.syncthing.net/u/fraternl)
#### Post date: [July 3, 2017, 7:56am UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/13 "2017-07-03T07:56:18Z")
Yes, I reported it as well. It was already fixed when they took on my ticket… I created the ticket on Sunday evening.
---
### Author:  [@Sune1337](https://forum.syncthing.net/u/Sune1337)
#### Post date: [July 11, 2017, 2:06pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/14 "2017-07-11T14:06:52Z")
It seems the issue is back. File gets deleted by Nod32 using definitions from 2017/07/11. 
---
### Author:  [@ProactiveServices](https://forum.syncthing.net/u/ProactiveServices)
#### Post date: [July 11, 2017, 3:44pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/16 "2017-07-11T15:44:11Z")
Confirmed fixed with Eset virus definitions 15729.
---
### Author:  [@artemis](https://forum.syncthing.net/u/artemis)
#### Post date: [August 4, 2017, 6:29pm UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/17 "2017-08-04T18:29:05Z")
It’s been over a month and Kaspersky is still blocking syncthing. I’ve reported the issue a number of times to Kaspersky, but so far there has been no progress. Is anyone else still having issues?
---
### Author:  [@ProactiveServices](https://forum.syncthing.net/u/ProactiveServices)
#### Post date: [August 5, 2017, 12:48am UTC](https://forum.syncthing.net/t/false-positive-kaspersky-eset-nod32-currently-flagging-syncthing-exe-as-infected/10081/18 "2017-08-05T00:48:15Z")
I got an autoreply but nothing else from Kaspersky. They have been detecting most, if not all, of the versions (release and full) since this one.
Time to vote with your wallet.