Bitdefender Antivirus Free - English GUI

Nope. Just MBAE Free perpetual beta (real-time exploit defense). Latest build available here: https://www.malwarebytes.com/antiexploit/

The free beta link is reached by clicking on the "Go to Forums" link... the latest updates are always listed here.

 

Latest build available here:
https://forums.malwarebytes.com/topic/184939-mbae-109-latest-standalone-beta/

 

Agreed. Very annoying! It's been like this for ages.

 

Maybe it's a Win10 thing. I don't have any issues using BD on Win7 ...

 

I received this answer from Bitdefender support regarding the Windows Security Center warning;

Hi shadek,

It is possible for Windows to display this message if it checks while Bitdefender is still downloading or installing an update. You can ignore it as Bitdefender will make sure it updates when it needs.
As long as the Events don't indicate an update error you're good to go.

Best regards,
Andrei Cimpeanu
Technical Support Team Leader

The notification is benign and I can confirm that it disappear as soon as Bitdefender successfully update itself automatically.

 

Please ignore all bugs in Bitdefender, as long as your computer isn't infected it's no problem.

 

Came across a probable malware which was not detected by bf which is rare.

http://imgur.com/a/0nZOL

It then proceeded to download a file named "Chrome_59.3.8.1.js".

There are only 4 detections on virustotal as of today. How do I report it to bf so they can analyse it?

Edit: Never mind I found it. Submitted to multiple av vendors and ms.

 

Found this. Looks nasty.

https://www.hybrid-analysis.com/sam...00304c53d061f296e37a69656a6?environmentId=100

Does the SHA256 match yours?
65763702ec2a3c297aa89929ca98df56afe4500304c53d061f296e37a69656a6

 

BD-free-2016 auto updated to 1.0.8.8

 

Yes that is it.

 

Possible false positive. Virus total now only shows 2 detections. None now from Trend Micro.

 

More than likely it is. One of the two products detecting it is Rising, which has major issues with false positives.

 

but still it has to be something shady.. look at the analysis https://www.hybrid-analysis.com/sam...00304c53d061f296e37a69656a6?environmentId=100.

The method by which it downloaded itself was shady showing me a false update chrome screen and downloading a file off dropbox.

 

Maybe Trend sees the .js file as okay but the issue is the payload on dropbox.

 

Whatever it was I will get a report from bf within 72 hrs. Unable to track my submission on MS I do not know why, but I guess virustotal should be able to provide the progress with my various reports in the coming days.

 

Well this is disappointing.. opened a friend's usb drive and sure enough there were 2 weird executables there. Didn't autoplay...didn't click on them Bf detected one and then I could no longer see the hidden executables. I though they were deleted but nope it has seemingly successfully infected my computer, I can no longer enable the show hidden files option like effing windows xp days and after all this time. Damn I miss applocker Now what do I do?
Guess I will restore from a system backup. Damn.

 

Since you didn't open the files, then I highly doubt your system is infected.

 

This is just a suggestion for the future, for third party USB drives and flash drives it is better to plug them in sandboxed (with Sandboxie free or paid) even better on a virtual volume (Shadow Defender), I would never trust any AV as a first line of defense... I's good you have an image to restore.

 

Yeah you're right. I don't think it was able to fully infect the system since other avs don't detect anything on the computer but some part of it was able to run since my show hidden files option is disabled. Dont see anything in autoruns or procexp.. Guess I was blinded by the "windows 10 is the most secure version of windows ye"t deal.

It is a sort of partial infection if it is indeed possible since my show hidden files option has been disabled.

 

I restarted and the hidden items could be enabled once again without my doing anything. It seems bf cured it as soon as it started to run. I will restore still just in case. Lesson learnt again after a long time.

 

Since you didn't launch any of the files yourself, then really nothing should have run as they won't run by themselves. Bitdefender scanned the files when you opened the folder in Explorer, and detected and quarantined the infected file. With most antiviruses, just opening a folder in Explorer, leads to the folder being scanned.

 

I understand that is the on access scanner working...

Now that i am replaying the events in my mind, i think the problem started when the icon of the file was displayed in explorer. I tried to upload one file to virustotal since i was receiving no notifications from bf (only a generic exe icon was being displayed up until that point).. in order for it to be uploaded it had to be added to exclusions, and thats when its icon displayed and subsequently i noticed I didn't see the hidden folders and files anymore but i also started receiving notifications of blocked threats from bf at that point.

Curiosity did nearly kill this cat apparently.

The executable having gained access to the registry leads me to believe it exploited some vulnerability in explorer while it was generating the icon for the file.

 

But if can't gain access to the registry unless you manually run it.

 

That's what I'm trying to say, I did not explicitly run the file, but if it still managed to change the hidden file policy when I had excluded it in order to upload to virustotal, there has to be some vulnerability which it exploited in explorer when it displayed the icon for the file. Else how did it manage to change these settings without being run on simply uploading it to virustotal through chrome?

 

Now detection has risen to 8... ironically none from the vendors that I submitted the file to (MS, avast, bf, avira)...