Repository navigation
Antivirus reaction on DeepSeekGUI UPDATE 1.3.0 #6
Description
Bug Report
DeepSeekGUI Version: 1.2.1
(v1.3.0 update was downloaded, then removed by antivirus)
DSH Version: 0.2.1-rc.2 (bundled)
Windows Version: Windows 10 Pro 22H2, build 19045.6456
Home Type: managed (profile: web)
What happened
On 2026-10-28 Kaspersky 21.26 removed DeepSeekGUI — this was not a crash.
- ~15:27 the app failed to start; the launcher logged a readiness timeout on its internal service (
deepseekgui-main.log.1):
2026-10-28T12:27:44.878Z [error] [deepseekgui] Startup failed (readiness): The DSH service was not ready within 60000ms (127.0.0.1:3080) - Kaspersky "Activity monitoring" (PDM) terminated the process:
PDM:Trojan.Win32.Generic, object type Process, objectDeepSeekGUI.exe. - The app had already downloaded the v1.3.0 migration helper into
%APPDATA%\DeepSeekGUI\updates. - An on-demand scan then removed that helper:
UDS:Trojan.NSIS.Kryptik.gen, precision Exact, object type File. DeepSeekGUI.exeitself was quarantined (a 233 MB.klqappeared at 16:11), so the installation is broken: only the Electron DLLs andUninstall DeepSeekGUI.exeremain inPrograms\DeepSeekGUI.
I believe this is a false positive, because the removed helper is byte-identical to the published release asset: its SHA256 (2b0059aa51a11483cf6b3ae6b368b0b8fb5bf3b9791e809ae9297568a1e96b40) matches SHA256SUMS.txt for v1.3.0 exactly, so the binary was not modified in transit.
Diagnostics
No diagnostics bundle is possible: the app was removed by the antivirus, so the feedback button in the bottom-left corner is no longer available. Instead, the antivirus events and the launcher log are attached below.
Auto-collected diagnostics (click to expand)
[Event 1 — Activity monitoring, process terminated]
Event: Object deleted
User: UDAV-NOUT\work
User type: Active user
Component: Activity monitoring
Result: Deleted
Result description: Deleted
Type: Trojan program
Name: PDM:Trojan.Win32.Generic
Threat level: High
Object type: Process
Object name: DeepSeekGUI.exe
Object path: C:\Users\work\AppData\Local\Programs\DeepSeekGUI
[Event 2 — Scan, file removed]
Event: Object deleted
User: UDAV-NOUT\work
User type: Active user
Component: Scan
Result: Deleted
Result description: Deleted
Type: Trojan program
Name: UDS:Trojan.NSIS.Kryptik.gen
Precision: Exact
Threat level: High
Object type: File
Object name: DeepSeekGUI-Migrate-1.3.0.exe
Object path: C:\Users\work\AppData\Roaming\DeepSeekGUI\updates
Object MD5: 725726F29AADBBA9036EF9AEA7C7DAD5
Object SHA256: 2b0059aa51a11483cf6b3ae6b368b0b8fb5bf3b9791e809ae9297568a1e96b40
[Launcher log]
2026-10-28T12:27:44.878Z [error] [deepseekgui] Startup failed (readiness): The DSH service was not ready within 60000ms (127.0.0.1:3080)
Additional context
- Kaspersky 21.26 (build from 2026-10-28), Windows 10 Pro 22H2.
- The helper is a small unsigned NSIS installer that downloads and launches another
.exe. That combination (unsigned launcher + download-and-execute + writes to%APPDATA%) matches both the behavioural (PDM) and signature (UDS) heuristics, so the detection may be structural rather than file-specific. - Suggestion: code-sign
DeepSeekGUI-Migrate-1.3.0.exe(and the main installer) with an Authenticode certificate, and/or submit the file to Kaspersky as a false positive. Signing would likely stop the PDM verdict, which was triggered by behaviour on the unsigned binary. - The app store cache still contains
verified.jsonwithversion: 1.3.0and the matching SHA256, which can be used to confirm the identity of the removed file.
Activity
See-Sol-Lab commentedon Nov 3, 2026
Thanks a lot for the detailed report, and especially for checking the SHA256 against
SHA256SUMS.txt. That confirms the file you had is exactly the one we published.This is a false positive. The migration helper is a small, unsigned NSIS wrapper. It unpacks a PowerShell script to a temp folder and runs it with a hidden console. The script then downloads the official DeepSeek Harness installer and installs it silently, after checking its size, SHA-512 and DeepSeek's code signature. That pattern (unsigned launcher, hidden script, download and run another exe) looks a lot like a malware dropper to behavioural and reputation-based detection, which matches both verdicts you saw.
Your data is safe. Kaspersky removed program files only. Your sessions, keys and settings under
%APPDATA%\DeepSeekGUIand your managed home were not touched, and the helper itself never modifies or deletes DeepSeekGUI data.To get going again, any of these works:
1. Recommended: install the official app and the QoL Pack directly. This is where DeepSeekGUI is heading anyway. You get updates straight from DeepSeek, and there's no helper exe for an antivirus to flag.
You can also just hand this whole step to an AI coding agent (e.g. paste this issue into it). Everything above is plain download, install and one CLI command.
Your old DeepSeekGUI sessions are not copied by this route. They stay where they are. If you want them in the official app later, run option 3 once. It skips steps that are already done and only merges the data.
2. Restore and retry: in Kaspersky, open Quarantine, restore
DeepSeekGUI.exe, then add%LOCALAPPDATA%\Programs\DeepSeekGUIand%APPDATA%\DeepSeekGUI\updatesto the exclusions (Settings → Security settings → Exclusions). Start DeepSeekGUI and run the update again.3. Run the helper manually: download
DeepSeekGUI-Migrate-1.3.0.exefrom the v1.3.0 release, check it againstSHA256SUMS.txt, add it to Kaspersky's exclusions, and run it. It does not need DeepSeekGUI.exe to be present, because it reads your data folder directly.If anything still fails, please post the error text here and we'll take a look.
udaff-rus commentedon Nov 6, 2026
No problem. I restored all the sessions right away. I just wanted to warn you about this error and the antivirus reaction.
See-Sol-Lab commentedon Nov 6, 2026