Malicious Command Line detected by Bitdefender. What should I do?

For the last half hour or so, I’ve been getting popups from Bitdefender saying that a malicious command line has been detected. It is accompanied by the following message:

“Feature: Antivirus AC:\Windows\System32\wbem\WmiPrvSE.exe was passed a malicious command line and has been blocked. Your device is now safe.
Command line: "C:)Windows\System32\wbem\WmiPrvSE.exe" -secured -Embedding”

I’m using my phone to post this and I currently have my computer disconnected from the internet.

I’m not sure why this is happening. I have not installed anything on my computer recently and I primarily use it to browse the internet on commonly visited websites.

Any advice? I’m pretty terrified.

Find more posts tagged with

Accepted answers

All comments

olivea

I am having the exact same issue, at the exact same time. Could it be a broader problem with Bitdefender?

BMillPA

I'm getting the same issue. At the time of the errors, my computer was disconnected from the Internet and had been for an hour or so, so there shouldn't have been any activity that would have triggered this. I had multiple warning prior to this malicious command line error that said:

The app hklm\software\classes\wow6432node\clsid\… infected with CMD:Heur.BZC.Cross.1.09D71697

I typed search the CMD:Heur.BZC.Cross part and Bitdefender, because I thought heur might mean heuristic, and it looks like it does based on the search results which stated:

cmd: This part of the alert indicates that the activity originated from a command-line interface, such as cmd.exe or PowerShell.
heur: This stands for "heuristic," which means the detection was based on the software's analysis of a program's behavior, not a pre-defined signature. This type of detection is used to catch new or unknown threats that haven't been cataloged yet.
bzc.cross: These are internal identifiers used by Bitdefender to categorize the type of suspicious behavior observed. In isolation, they don't provide much information to the end user.

So it looks like a heuristic analysis (i.e., something trying to detect previously unknown viruses) may be picking this up.

BMillPA

And to clarify, I'm not suggesting that the heuristics are finding a legitimate new problem. In fact, I suspect the heuristic analysis is an imperfect tool and this might be a false-positive. I say that in part because looking on the forum, this post and others like it have racked up hundreds of views in a relatively short time. Which suggests there's a lot of folks curious about this all of a sudden.

The software seems to update multiple times per day for me so it may not mean much, but I do see that BitDefender applied an update 2.5 hours before this error started happening.

Gjoksi

Hello.

It seems that some users are experiencing the same issue, which i believe is a false positive.

Anyway, as a workaround open your Bitdefender program, go to Protection → Antivirus → Advanced and disable / toggle off "Scan command line".

Next, exclude the file and/or the folder from Bitdefender Antivirus scan, by following the steps from this article:

https://www.bitdefender.com/consumer/support/answer/13427/

Finally, do the steps below.

First, take screenshot(s) of the issue,

create a log file on your Windows device using Bitdefender Support Tool, by following these steps:

https://www.bitdefender.com/consumer/support/answer/1733/

and

create a log file on your Windows device using BDsysLog, by following these steps:

https://www.bitdefender.com/consumer/support/answer/1922/

Next, contact Bitdefender Consumer Support by e-mail:

https://www.bitdefender.com/consumer/support/help/

with short description of the issue.

After that, you will get an automated reply by the Bitdefender Customer Care Team, with your ticket number.

Now, in reply to that automated reply, you can send the screenshot(s) you already took and the log files you already created in the first step.

Since you are all done, just wait for the support engineers to investigate your issue and find a solution to fix the issue.

Remember that the screenshot(s) and the log files will help a lot to the support engineers for better and faster investigation on your issue and finding a solution.

NOTE: If any of the log file is larger than 25MB, you can upload the log file here:

https://upload.bitdefender.net/

After the upload is done, you will get a notification with the file's URL and then you can share the file's URL with the Bitdefender Consumer Support.

Regards.

@camarie @Alexandru_BD @dvsls