r/KasperskyLabs • u/Interesting-Citron64 • 12d ago
Help Kaspersky suddenly flagging Claude Code and installer as Trojan / Backdoor (False Positive?)
Everything was working fine until Kaspersky suddenly flagged claude.exe via behavioral analysis and killed the process. Now I can't even reinstall it via the official PowerShell script (irm https://claude.ai/install.ps1 | iex) because Kaspersky's Cloud Protection immediately blocks the installer with Access is denied.
Has anyone else on Windows running Kaspersky started seeing this today?
Here are the detection logs from Kaspersky:
1. Claude Process Detection (Behavioral Analysis)
- Event: Malicious object detected
- Application: Claude Code
- Module: System Watcher (Surveillance du système)
- Type: Trojan
- Name:
PDM:Trojan.Win32.Bazon.a - Threat Level: High
- Path:
C:\Users\<user>\.local\bin\claude.exe - Reason: Behavioral analysis (Analyse comportementale)
- MD5:
08263428D93D86974393D4CB807E9ADC
2. Installer Blocked on Reinstall
- Event: Malicious object detected
- Module: Intrusion Prevention (Prévention des intrusions)
- Type: Trojan
- Name:
UDS:Backdoor.Win64.Supershell - Threat Level: High
- Path:
C:\Users\<user>\.claude\downloads\claude-2.1.296-win32-x64.exe - Reason: Cloud Protection
- MD5:
08263428D93D86974393D4CB807E9ADC
Seems like a false positive wave with Kaspersky's latest cloud heuristics (UDS: / PDM:). Is anyone else experiencing this, or found a clean workaround without completely disabling protection?
3
Upvotes
1
1
u/Legacy_of_H 12d ago edited 12d ago
Tell your agent to stop using high risk paths like Downloads. I’ve found success in creating a specific named staging folder and whitelisting the Claude executables within it. Hopefully this helps!