# Kaspersky says vstconnect.dll has Trojan.MSIL.CoinStealer.tf

**URL:** <https://forums.steinberg.net/t/kaspersky-says-vstconnect-dll-has-trojan-msil-coinstealer-tf/85675>\
**Category:** Cubase\
**Tags:** cubase-9\
**Created:** [January 9, 2017, 10:52pm UTC](https://forums.steinberg.net/t/kaspersky-says-vstconnect-dll-has-trojan-msil-coinstealer-tf/85675 "2017-01-09T22:52:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![LeroyNL](https://avatars.discourse-cdn.com/v4/letter/l/91b2a8/32.png) [@LeroyNL](https://forums.steinberg.net/u/LeroyNL)\
**Post date:** [January 9, 2017, 10:52pm UTC](https://forums.steinberg.net/t/kaspersky-says-vstconnect-dll-has-trojan-msil-coinstealer-tf/85675/1 "2017-01-09T22:52:17Z")

</div>

Kaspersky has just detected Trojan.MSIL.CoinStealer.tf in vstconnect.dll and moved it to quarantine. This is probably a false positive and I have already reported this to Kaspersky.

The SHA256 hash of my vstconnect.dll is 46d9976e40a8b6ae4a22a320fca799a15f08b4c99e6b67a4a00329226219714a. Can anyone upload their vstconnect.dll from “C:\Program Files\Steinberg\Cubase 9\Components” to [https://virustotal.com](https://virustotal.com) and check if the SHA256 hash is the same? Please make sure you have Cubase 9.0.10 installed.

Perhaps someone from Steinberg can comment on the validity of the hash as well.

---

<div class="post-metadata">

**Author:** ![Ed\_Doll](https://dub1.discourse-cdn.com/steinberg/user_avatar/forums.steinberg.net/ed_doll/32/138966_2.png) [@Ed\_Doll](https://forums.steinberg.net/u/Ed_Doll)\
**Post date:** [January 10, 2017, 9:02am UTC](https://forums.steinberg.net/t/kaspersky-says-vstconnect-dll-has-trojan-msil-coinstealer-tf/85675/2 "2017-01-10T09:02:02Z")

</div>

Thanks for reporting! We have experienced this here as well. Let’s see what can be done.

---

<div class="post-metadata">

**Author:** ![Ed\_Doll](https://dub1.discourse-cdn.com/steinberg/user_avatar/forums.steinberg.net/ed_doll/32/138966_2.png) [@Ed\_Doll](https://forums.steinberg.net/u/Ed_Doll)\
**Post date:** [January 10, 2017, 9:24am UTC](https://forums.steinberg.net/t/kaspersky-says-vstconnect-dll-has-trojan-msil-coinstealer-tf/85675/3 "2017-01-10T09:24:50Z")

</div>

Looks like the latest update from Kaspersky from this morning fixes the issue.