Help investigating what BitDefender did

profarcity

I was duped into copy/pasting and running a malicious powershell ****** on my Windows 10 PC using Windows Run. As soon as I did this, Bitdefender had a popup that appeared, which made me realize what I had done. At that point I shut the computer down quickly. Unfortunately I can't remember exactly what the Bitdefender popup message was, so I'm not sure if Bitdefender stopped the ****** or not (or even if it has the capability to do so).

If it is relevant, I had subscribed to a BitDefender Family Pack, but the subscription had expired. However I had just left BitDefender on my computer, so whatever protection that gives me is what I had at the time.

At this point I am nervous about booting back into my normal Windows environment, and the safest option seems to be to boot into another environment using the USB drive to try and analyze what actually happened to my computer. I have already done this with Hirens Boot USB and it works well to give me access to my C drive files, etc.

Can someone help me know where I can go to examine what Bitdefender might have done, and see if it actually stopped the ****** from running - i.e. is there a log somewhere or event viewer to show the timeline?

If I can somehow demonstrate that Bitdefender stopped the ******, I feel like then I can use the computer again without worry.

If not, then I need to go to the next step of trying to figure out exactly what might have been done to my computer through the ******, so any help there would be appreciated as well.

I do have a copy of the malicious ****** if anyone wants to see it.

Thanks for any help!

Alexandru_BD

Hello @profarcity,

So, if Bitdefender displayed a pop-up when the malicious s.c.r.i.p.t was run, this likely suggests that it took some action there. But since you shut down your computer, I think the only way to find out what happened would be to check the Notifications section in the product UI..

When Bitdefender finds an infection on your computer, it usually takes automatic action against it and gets rid of the malware without requiring any input on your side. To be sure the infection is gone, bring up your Bitdefender security program and click on Notifications in the menu on the left-hand side of the interface. Every time a critical event occurs, a counter can be noticed on the bell icon. Access the Critical tab, then click the entry concerning threat detection. It will show a short description of the action Bitdefender took on the malware, and the date and time when it occurred. 

If the Notification indicates that Bitdefender successfully blocked the threat, you are safe. Bitdefender already took care of the infection. On the other hand, if the Notification states that the threat could not be deleted, follow the steps from this article to learn how to deal with the malware:

https://www.bitdefender.com/consumer/support/answer/2576/

NOTE: Before doing all this, access your Central account and make sure you still have an active subscription. Once your Bitdefender subscription ends, the software will stop functioning, and you will no longer have access to its features. So, this would be the first thing to check before powering on your PC.
All you have to do is open your browser (use another device in this case), go to https://central.bitdefender.com/ and sign in. There you can check if your protection is still active under the 'My Subscriptions' tab. If the subscription expired, renew it before anything else.

Now back to that procedure, if it's necessary to manually remove the infection, check this article:

https://www.bitdefender.com/consumer/support/answer/2127/

And if the threat cannot be eliminated while the operating system is running, resort to this procedure:

https://www.bitdefender.com/consumer/support/answer/29132/

NOTE: Bitdefender Rescue Environment is only available in Windows 10 and later.

Finally, if nothing helps, follow the below instructions and get in touch with the Support teams for further assistance.

https://www.bitdefender.com/consumer/support/answer/1477/

Attach the .xml file to your support ticket for further troubleshooting. To open a ticket for the Support teams, you can use this link:

https://www.bitdefender.com/consumer/support/help/

State your contact reason / choose request category, then choose from the available contact channels, chat, phone and email/ticket. Chat would be the fastest way to reach them.

Let us know what worked for you.

Regards,

Alex