Why does Bitdefender ignore exceptions?

Everytime I restore a quarantined item it creates an exception, however it ignores this everytime something happens and it re-quarantines everything I've made exceptions for (both manually and via restoring). It's frustrating that this feature doesn't work and it's one of the few that give us control of our device and security of it. Kaspersky never had this problem.

Find more posts tagged with

quarantined

exceptions

Accepted answers

All comments

Gjoksi

Hello.

Please, follow the steps below.

-- STEP 1 --

Repair Bitdefender, by following these steps:

https://www.bitdefender.com/consumer/support/answer/13429/

-- STEP 2 --

If the instructions from Step 1 didn't help, uninstall the Bitdefender program using the Uninstall Tool:

https://www.bitdefender.com/links/uninstall_consumer_paid.html

It will completely remove the program.

Next, reinstall Bitdefender from your Bitdefender Central account and see if the issue has been solved, as reinstalling the program usually solves the issues.

-- STEP 3 --

If the instructions from Step 2 didn't help, follow the instructions in this step.

First, take screenshot(s) of the issue

and create a log file on your Windows device using Bitdefender Support Tool, by following these steps:

https://www.bitdefender.com/consumer/support/answer/1733/

Next, contact Bitdefender Consumer Support by e-mail:

https://www.bitdefender.com/consumer/support/help/

with short description of the issue.

After that, you will get an automated reply by the Bitdefender Customer Care Team, with your ticket number.

Now, in reply to that automated reply, you can send the screenshot(s) you already took and the log file you already created in the first step.

Since you are all done, just wait for the support engineers to investigate your issue and find a solution to fix the issue.

Remember that the screenshot(s) and the log file will help a lot to the support engineers for better and faster investigation on your issue and finding a solution.

NOTE: If the log file is larger than 25MB, you can upload the log file here:

https://upload.bitdefender.net/

After the upload is done, you will get a notification with the file's URL and then you can share the file's URL with the Bitdefender Consumer Support.

Regards.

@camarie @dvsls @Alexandru_BD

Alexandru_BD

Hi,

I think there can be a few reasons behind this. The real-time protection or behavior-based detection, namely Advanced Threat Defense might override the exception if the file exhibits malicious behavior at runtime, or if the file is in a location monitored more strictly, like startup folders or temp directories. Or if the exception was set only for the antivirus and not for other modules as well, OTP, ATD.. Heuristic rules may override manual input.

The first thing to check in my opinion would be if the exception is added for all relevant modules.
There can be other scenarios, if the quarantined file is modified or re-downloaded after restoration (e.g., from a game patcher or updater), the antivirus may see it as a new file, not covered by the previous exception.

In this case I think you should confirm the exact file path and checksum haven't changed, adding the new version to the exception list, if this applies. Also, exceptions may not be saved properly due to lack of admin rights when creating them, or group policy restrictions (common in enterprise environments), or even conflicts with other security software. So, it's hard for me to pinpoint the exact reason without knowing the specifics of your setup there..

Another thing to keep in mind is that security solutions rely on cloud intelligence these days. So, a file marked as a known threat on a larger scale may still be quarantined.

Regards

-REDACTED-

I had a power outage last night, and this morning when I powered my PC back on this program went ahead and deleted an entire program I had marked with an exception WITHOUT my permission or input before allowing my PC to boot. I'm finding an alternative and uninstalling this AV which I cannot begin to describe in the ways I wish to as no AV should be programmed to do such a thing without the OWNER OF THE DEVICE's input for confirmation.

Alexandru_BD

Sorry to hear that…

-REDACTED-

After two hours of continuous non-stop searching I've come to the conclusion that outside of Kaspersky (which was banned in America for not bending the knee to our government) this is the only AV worth a damn, so I'm S.O.O.L.

Alexandru_BD

But what type of file/program is it? Because this could also be a false positive, and in this case you can report an incorrect detection to Bitdefender Labs. You can use the form available at the link below:

https://www.bitdefender.com/consumer/support/answer/29358/

Just trying to make sense of this, maybe sending a sample would help sort this out.

-REDACTED-

It's something I've been working on for personal usage while teaching myself coding, I set it up to use an API for question answering and I guess it didn't like that and it targeted everything else I had that used the same API I'm guessing. I can't provide a sample or report an incorrect detection because I no longer have the file it decided was too dangerous to be on my computer. Which is why AVs shouldn't be allowed to perform actions without the user's input like it did.

I apologize for my rudeness yesterday, losing all my progress including my backups sent me off the rails.

Alexandru_BD

I get it, I understand this can be very frustrating, so no need to apologize, we're good.

This is what I suspect, that ATD had something to do with it based on its behavioral detection capabilities, most likely it flagged that API because it took some actions that resembled a threat to the system, which obviously wasn't the case here.. The thing is, when Bitdefender finds an infection, it usually takes automatic action against it and gets rid of the malware without requiring any input on the user side (there are exceptions) This is probably what happened in this case as well, the software considered those files to pose a threat, so it removed them..

-REDACTED-

6 days late cause I put in a lot of effort to rebuild what I could. I understand why it would do such a thing but the issue is that it shouldn't when an exception is made to protect files, code, or APIs. Up until this issue I've loved Bit Defender and considered it to be Kaspersky's dollar store knock off that did it's job properly, and so far this is the only thing about it I don't like and think needs changed.