Bitdefender Properties displays no digital signatures

Right-clicked BD icon in taskbar, clicked Properties then Digital Signature tab, and no signatures were displayed in either the Embedded or Catalogue fields. Is this normal. Also found no signatures for a few other app, e.g., Edge. Unusual?

This coincides with what i think are unusual Event Viewer entries. OneApp_IGCC_WinService logged "session logoff" and "logon" events, "Remote Connect" and "Disconnect" events, "ConsoleConnect" and "Disconnect" events, together with several administrative "Warning" and "Error" events, all happening at the time i was visiting a social streaming web site.

Any ideas what's going on here?

Find more posts tagged with

Accepted answers

All comments

Gjoksi

Hello.

My specs:

Asus X551CA

OS Windows 10 Pro 22H2 x64 With Latest Windows Updates Installed

OS Build 19045.6216

Experience Windows Feature Experience Pack 1000.19062.1000.0

BD Total Security 27.0.53.265

I just checked and here are the results:

As you can see from the screenshot, the file "seccenter" is digitally signed in the file itself.

As you can see from the screenshot, the file "bdservicehost" is digitally signed in the file itself and the digital signature is also stored in a catalog file, which is found in C:\Windows\System32\CatRoot{F750E6C3-38EE-11D1-85E5-00C04FC295EE}.

Maybe @camarie, @dvsls and/or @Alexandru_BD can give you more insights on this matter and help you with the issue.

Regards.

camarie

"Right-clicked BD icon in taskbar, clicked Properties then Digital Signature tab"

I assume right-click on BD taskbar icon (probably seccenter.exe), then clicked on Properties, correct? If this is the case, the Properties dialog from task bar and the one from right-click > Properties directly on file are not the same. The Digital Signatures tab is displayed only in the second case, although I'm not sure why. Probably because the taskbar invocation might refer to the properties of the representation of the file (aka Shortcut) and not to the file itself, while the invocation directly from the file considers all the file properties (ok, not all, but specific to the executable file) and not its taskbar item, which is not a file.

If you compare the two property dialogs, the first is displaying shortcut properties, while the second displays file properties.

AckOop

I have a Dell Laptop G5 5500. I launch BD Total Security from the start menu, which opens the BD window on my desktop, which is accompanied by a BD icon appearing on my taskbar. I rt-click the icon to open Properties. On the Digital Signatures tab i find no signatures (see attachment below)

I have a very rudimentary understanding of software, but i've always been taught that valid s/w is digitally signed. If not signed, then be very suspicious of it. In fact, i saw the creator of Sysinternals during a Youtube presentation on how to spot malware on your pc use that as the sole criterion for signaling out a bad piece of software and deleting it. Upon random searches of my laptop, i'm finding many instances of empty Digital Signature tabs, not just for my BD s/w.

I've witnessed other peculiarities on my laptop, such as opening a single instance of a webpage, but the browser History lists 2 instances of that webpage. When comparing the page sources for each, there are slight variations in the coding. (Not being a programmer, i couldn't begin to try describing for you their differences.)

Also, upon recently starting up my laptop, i was surprised to find 2 new BD shortcuts on my desktop, which are typically put there by default during the installation process. First, i never put shortcuts from software on my desktop. Second, in the session prior to that, i had done nothing to alter the s/w settings or infrastructure in any way, including updates or otherwise, much less reinstall the s/w.

I've also had trouble with the browser by losing complete control over it, unable to click or select anything within the browser for a stretch of about 30 min.

Additionally, I've noticed remote login sessions being logged at seemingly random times, usually 2-3 days apart, for OneApp_IGCC_WinService (event ID 0) in Event Viewer, even though i've disallowed remote assistance in Systems Properties and disabled all Remote Desktop services.

I also believe that on certain social streaming web sites, some streamers are activating a microphone in my laptop or possibly my phone or elsewhere on my premises, because they've made it known they can hear me. This in spite of the fact i'm there strictly as a (supposedly) anonymous guest observer, not a logged in participant or broadcaster. Even if i wanted to participate, i couldn't for the mere fact i physically removed the webcam and microphone from my laptop long ago.

This is not an all-inclusive list of peculiarities, but i should also mention that beginning with the past week, i can no longer enable Secure Mode in the Bios settings. The laptop fails to boot up when i do. This does not predate all the peculiarities. Some have been occuring for 2-3 years now.

I suspect someone is tracking my online activities and has possibly found a way into my machine to control it. How to confirm if true, and how to prevent it going forward?

Gjoksi

Hello.

In that case, follow the steps below.

First, scan (and disinfect, if needed) your PC with Bitdefender Rescue Environment:

https://www.bitdefender.com/consumer/support/answer/29132/

Next, restart your PC and see if the issue has been solved.

If the steps provided above didn't help, do the following steps:

First, take screenshot(s) of the issue.

Next, create a log file on your Windows device using Bitdefender Support Tool, by following these steps:

https://www.bitdefender.com/consumer/support/answer/1733/

and

create a log file on your Windows device using BDsysLog, by following these steps:

https://www.bitdefender.com/consumer/support/answer/1922/

Finally, contact Bitdefender Consumer Support by e-mail:

https://www.bitdefender.com/consumer/support/help/

with short description of the issue.

After that, you will get an automated reply by the Bitdefender Customer Care Team, with your ticket number.

Now, in reply to that automated reply, you can send the screenshot(s) you already took and the log files you already created in the first step.

Since you are all done, just wait for the support engineers to investigate your issue and find a solution to fix the issue.

Remember that the screenshot(s) and the log files will help a lot to the support engineers for better and faster investigation on your issue and finding a solution.

NOTE: If any of the log file is larger than 25MB, you can upload the log file here:

https://upload.bitdefender.net/

After the upload is done, you will get a notification with the file's URL and then you can share the file's URL with the Bitdefender Consumer Support.

Regards.

AckOop

Thank you, i will carry out your instructions. For future reference, it would be helpful to know if i was correct in interpreting the metrics as signs of an incursion. Specifically,

Regarding the signatures, or lack thereof, under what circumstances would it be acceptable that the Digital Signatures tab contain zero signatures (whether referencing a file, app, or other Windows object/entity), or is that always a sign of a problem that must be rectified?
Regarding the OneApp_IGCC logged events that describe RemoteSession Connects and Disconnects, are these always a sign that someone has successfully infiltrated my laptop, or are these events not unexpected, possibly reflecting connections to Microsoft or other developers to carry out s/w updates, perform maintenance procedures, etc.?

I appreciate all your help. And if you know of any PC Security for Dummies literature, i would appreciate that also, hopefully save the community some effort.