# Kaspersky treats Syncthing as virus (false positive)
**URL:** https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659
**Category:** Support
**Created:** [June 19, 2016, 7:39pm UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659 "2016-06-19T19:39:53Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@ErichHeer](https://forum.syncthing.net/u/ErichHeer)
#### Post date: [June 19, 2016, 7:39pm UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/1 "2016-06-19T19:39:53Z")
**This is a false positive.**
// edit by @calmh
* * *
Kaspersky treats Syncthing as virus and deletes the EXE. After Re-Install happens exactly the same.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [June 19, 2016, 8:05pm UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/2 "2016-06-19T20:05:38Z")
Unless you’ve gotten an infected binary from somewhere, I’d say Kaspersky is wrong.
Also, please stop using v0.11.3. It’s very old, even for the v0.11 branch, surely quite buggy, and extremely unsupported.
---
### Author:  [@theoky](https://forum.syncthing.net/u/theoky)
#### Post date: [June 19, 2016, 8:25pm UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/3 "2016-06-19T20:25:10Z")
My Kasperskies (both versions: Endpoint Security 10 and internet security 2016) recognize the current version v0.13.7 as [Trojan.Win32.Ebowla.ad](http://Trojan.Win32.Ebowla.ad), as well. Got the binaries from the github releases via autoupdate.
So let’s hope that the signature DB of Kaspersky is wrong and that they fix it soon.
---
### Author:  [@ProactiveServices](https://forum.syncthing.net/u/ProactiveServices)
#### Post date: [June 19, 2016, 8:28pm UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/4 "2016-06-19T20:28:58Z")
Please report this false positive to Kaspersky. Maybe that way they’ll be less likely to incorrectly categories Syncthing later.
---
### Author:  [@theoky](https://forum.syncthing.net/u/theoky)
#### Post date: [June 19, 2016, 8:41pm UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/5 "2016-06-19T20:41:32Z")
Submitted the url of the current windows release to the virusdesk of kaspersky.
Additionally, found this thread: [http://forum.kasperskyclub.ru/index.php?showtopic=50669](http://forum.kasperskyclub.ru/index.php?showtopic=50669)
But my “Google Russian” is not giving me much insight 😒
---
### Author:  [@ErichHeer](https://forum.syncthing.net/u/ErichHeer)
#### Post date: [June 19, 2016, 9:10pm UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/6 "2016-06-19T21:10:40Z")
version 11.3 \<=\> 13.7 that is a bit strange. I usually do the updates and I think that I used 13.? before.
Now I deleted the Syncthing folder and old data/downloads. Then I did the download again directly from SYNCTHING (win32).
Download was fine but as soon as I extracted/started SYNCTHING the Kaspersky popped up. First trying the repair and then deleting the SYNCTHING.EXE now with version 13.7 but with the same TROJAN.WIN32.EBOWLA.AD
---
### Author:  [@ErichHeer](https://forum.syncthing.net/u/ErichHeer)
#### Post date: [June 19, 2016, 9:27pm UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/7 "2016-06-19T21:27:35Z")
I just opened a support case with Kaspersky and put the syncthing-windows-386-v0.13.7.zip as attachment.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [June 20, 2016, 6:42am UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/8 "2016-06-20T06:42:57Z")
I’ve rebuilt a v0.13.7 binary on a clean Windows VM and it’s the exact same size as the official v0.13.7 download. There are a number of one byte differences along the way that I’m not 100% sure of why, but there’s no space for any malware to hide in the official download. I feel quite secure in saying that this is a false alarm.
---
### Author:  [@koshyg15](https://forum.syncthing.net/u/koshyg15)
#### Post date: [June 20, 2016, 8:32am UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/9 "2016-06-20T08:32:50Z")
Same here Kaspersky reports it as [TROJAN.WIN32.EBOWLA.AD](http://TROJAN.WIN32.EBOWLA.AD), got kaspersky to delete it, redownloaded it from the syncthing website kaspersky reported it as Virus again. Deleted it and removed it from all my machines Linux and all, just to be on the same side.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [June 20, 2016, 8:39am UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/10 "2016-06-20T08:39:00Z")
Again, this is a false positive.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [June 20, 2016, 8:39am UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/11 "2016-06-20T08:39:05Z")
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [June 20, 2016, 8:39am UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/12 "2016-06-20T08:39:16Z")
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [June 20, 2016, 3:34pm UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/13 "2016-06-20T15:34:32Z")
Resolved as of now when refreshing Virustotal at least;
[https://www.virustotal.com/en/file/e0cd618146663a554f3c5aaad69032f164c4993fc6919506edaaca4a78ee77a8/analysis/1466435029/](https://www.virustotal.com/en/file/e0cd618146663a554f3c5aaad69032f164c4993fc6919506edaaca4a78ee77a8/analysis/1466435029/)
(“AegisLab” and “Jiangmin” are still confused, but hey can’t win every battle.)
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [June 21, 2016, 2:14pm UTC](https://forum.syncthing.net/t/kaspersky-treats-syncthing-as-virus-false-positive/7659/14 "2016-06-21T14:14:23Z")