DeliciousStorage

If anyone wants to try and replicate it the steps are as follows for Windows 10 Pro Build 1909. 1. Pause protection 2. Download XMRig 3. Extract XMRig and move to a folder in a data drive 4. Add folder and application (xmrig.exe) to exclusions 5. Add xmrig.exe to "Specify trusted applications" in threats and exclusions settings 6. Turn off "Perform recommended actions automatically" in Interactive protection 7. Resume protection and open xmrig folder You should then get a popup asking if you want to delete xmrig.exe or add to exclusions, despite already adding both the folder and application to exclusions. If you select add to exclusions in the popup it will disappear and come back a couple of seconds later. This will repeat endlessly when you select add to exclusions, if you check your exclusions afterwards you will find a long list of duplicate exclusions.

So the antivirus reacted to something else that was in “couple of similar popups”. You also missed the fact that the program was initially getting deleted when it wasn’t running despite being in my exclusions, and that there was a weird bug with endless popups asking to add to exclusions. Surely you don’t consider this working as intended?

When I add a folder or application to my exclusions I expect it to work when I run it, which is what happens with Windows Defender. I don’t expect it to be stopped and automatically deleted as happens with the default settings. If you read my first post in full you will see that I already added it to my trusted applications so this doesn’t work as intended.

Without running the program when I enabled protection I got a popup asking me if I wanted to block it or add to exclusions, I added to exclusions, the popup closed but came back a couple of seconds later. This process kept repeating, I checked my exclusions and I had a long list of duplicate exclusions. I deleted it, paused protection again and re downloaded. Now I’m no longer getting a popup when it’s closed, but when I try to run it I’m getting a totally different popup (see attachment) asking me to Allow now or Block. I clicked on Allow now and remember choice but it still didn’t work, the popup kept closing and reappearing a couple of seconds later. Then I clicked on additional actions and something about a trusted application, and did the same for a couple of similar popups after that, and now finally I have it working. It was a total pain to get working and the point remains that the exclusions do not work as they should.

Yes, I did this.

A screenshot is in the attachment.

I already paused protection and added it to my exclusions when I downloaded it. When protection is re enabled and I try to run the program it still gets detected and deleted by Kaspersky.

I’m trying to use xmrig, a cryptocurrency miner downloaded from this github release. The program is legitimate, however it gets a false positive detection from Kaspersky as the source code is used in a lot of malware to mine cryptocurrency without the users consent. I’ve tried adding the folder and application to my exclusions, and also added it to my trusted applications, however it still gets stopped and deleted by Kaspersky. I haven’t been able to get it to work without pausing protection entirely, is there a solution for this? Windows defender does not have the same problem when adding the folder to my exclusions.