# Kaspersky accusing Cursor of being a trojan **URL:** \ **Category:** Help\ **Tags:** java\ **Created:** [September 29, 2025, 11:29pm UTC](https://forum.cursor.com/t/kaspersky-accusing-cursor-of-being-a-trojan/135408 "2025-09-29T23:29:20Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![lucianoGG](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/lucianogg/32/81433_2.png) [@lucianoGG](https://forum.cursor.com/u/lucianoGG)\ **Post date:** [September 29, 2025, 11:29pm UTC](https://forum.cursor.com/t/kaspersky-accusing-cursor-of-being-a-trojan/135408/1 "2025-09-29T23:29:20Z")
### Where does the bug appear (feature/product)? Cursor IDE ### Describe the Bug I already posted on GitHub and now I’m posting here again. Update: After reinstalling, it still happens. was using it normally when Cursor repeatedly closed, and Kaspersky flagged it as a trojan before deleting it… There was an update today, but I don’t remember if there was another one recently. > > > I was using it normally when Cursor repeatedly closed, and Kaspersky flagged it …as a trojan before deleting it... There was an update today, but I don’t remember if there was another one recently. > > \Image > > Evento: Objeto malicioso detectado > Aplicativo: Cursor > Usuário: XXXXXXX > Tipo de usuário: Iniciador > Componente: Inspetor do Sistema > Descrição do resultado: Detectado > Tipo: Cavalo de Troia > Nome: PDM:Trojan.Win32.Generic > Nível da ameaça: Alto > Tipo de objeto: Processo > Caminho do objeto: C:\\Users\\xxxx\\AppData\\Local\\Programs\\cursor > Nome do objeto: Cursor.exe > Motivo: Análise de comportamento > Data da versão dos bancos de dados: Hoje, 29/09/2025 13:40:00 > MD5: 1F0E626623BC4D7E8B68D9663B1AA39D Event: Malicious object detected Application: Cursor User: XXXXXX User type: Initiator Component: System Watcher Result description: Detected Type: Trojan horse Name: PDM:Trojan.Win32.Generic Threat level: High Object type: Process Object path: C:\Users\xxxx\AppData\Local\Programs\cursor Object name: Cursor.exe Reason: Behavioral analysis Database release date: Today, 09/29/2025 13:40:00 MD5: 1F0E626623BC4D7E8B68D9663B1AA39D ### Steps to Reproduce Kaspersky + Latest version ### Screenshots / Screen Recordings ![495358319-410e1cfc-f293-407f-a43b-a1d1e94ee34a.png](https://us1.discourse-cdn.com/cursor1/original/3X/6/a/6a449f1efc4766fa327887085254194e3aaa3b9d.png) ### Operating System Windows 10/11 ### Current Cursor Version (Menu → About Cursor → Copy) Latest version from the website ### Does this stop you from using Cursor Yes - Cursor is unusable ---
**Author:** ![condor](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/condor/32/73148_2.png) [@condor](https://forum.cursor.com/u/condor)\ **Post date:** [September 29, 2025, 11:42pm UTC](https://forum.cursor.com/t/kaspersky-accusing-cursor-of-being-a-trojan/135408/2 "2025-09-29T23:42:52Z")
hi @lucianoGG this is a not a trojan report but a very generic false positive that we have seen before though it is rare. Closing itself, trying to installing new version and similar steps are features apps do nowadays regularly. What is likely is that Cursor tried to update itself but antivirus prevented it by locking update installation files. Could you please post the exact Cursor version you have as the website was updated and we released also an update in the meantime. You may have to reach out to your antivirus provider to check and fix this false positive detection. ---
**Author:** ![lucianoGG](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/lucianogg/32/81433_2.png) [@lucianoGG](https://forum.cursor.com/u/lucianoGG)\ **Post date:** [September 29, 2025, 11:58pm UTC](https://forum.cursor.com/t/kaspersky-accusing-cursor-of-being-a-trojan/135408/4 "2025-09-29T23:58:36Z")
It didn’t happen during an update, since the same issue occurred earlier. I reinstalled it and the same thing happened again. **Version:** 1.7.17 (user setup) **Commit:** 1.99.3 **Date:** 34881053400013f38e2354f1479c88c9067039a0 **Electron:** 2025-09-29T03:10:26.099Z **ElectronBuildId:** 34.5.8 **Chromium:** undefined **Node.js:** 132.0.6834.210 **V8:** 20.19.1 **OS:** 13.2.152.41-electron.0 … ---
**Author:** ![condor](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/condor/32/73148_2.png) [@condor](https://forum.cursor.com/u/condor)\ **Post date:** [September 30, 2025, 12:01am UTC](https://forum.cursor.com/t/kaspersky-accusing-cursor-of-being-a-trojan/135408/5 "2025-09-30T00:01:15Z")
Thank you for the additional info. While it was not during update the case is still the same. Cursor has to execute terminal, 3rd party extensions, MCP servers and other features that may appear as suspicious. As there are many antivirus providers and this is a false positive overall, it is recommended that you reach out to your antivirus provider and let them check. ---
**Author:** ![deanrie](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/deanrie/32/1263_2.png) [@deanrie](https://forum.cursor.com/u/deanrie)\ **Post date:** [September 30, 2025, 5:31am UTC](https://forum.cursor.com/t/kaspersky-accusing-cursor-of-being-a-trojan/135408/6 "2025-09-30T05:31:35Z")
Hey, at the moment the solution is simply to add Cursor to your antivirus exceptions. ---
**Author:** ![system](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/system/32/99069_2.png) [@system](https://forum.cursor.com/u/system)\ **Post date:** [October 22, 2025, 5:32am UTC](https://forum.cursor.com/t/kaspersky-accusing-cursor-of-being-a-trojan/135408/7 "2025-10-22T05:32:03Z")
Closed on October 22, 2025, 5:32am UTC This topic was automatically closed 22 days after the last reply. New replies are no longer allowed.