Why Bitdefender Detect My PowerShell ****** as malicious Heur.BZC.ZFV.Boxter.834.73030A42

CHENG HAO YONG

Hi, i need to knows why bitdefender detect as PowerShell tried to load a malicious resource detected as Heur.BZC.ZFV.Boxter.834.73030A42 and was blocked.
At C:\Users\VALOR\Documents\VmwareShareFile\Untitled1.ps1:1 char:1

• function Show-Menu {

This ****** contains malicious content and has been blocked by your antivirus software.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : ScriptContainedMaliciousContent

Alexandru_BD

Hi,

I think this detection is more like a heuristic flag, meaning Bitdefender’s engine saw something in the PowerShell s.c.r.i.p.t that looks like suspicious behavior, not exactly a known malware. Bitdefender pays attention when behavior patterns resemble malware, but these sometimes result in false positives on PowerShell s.c.r.i.p.t.s, because PowerShell can be used for malicious purposes as well. Blocks may happen because such s.c.r.i.p.t.s frequently use patterns that heuristic engines associate with potentially risky activity, and this applies especially for custom or unsigned ones.

If the s.c.r.i.p.t is safe and the alert keeps recurring, add the ****** or its folder to Bitdefender’s Antivirus exceptions so it won’t block it again.

https://www.bitdefender.com/consumer/support/answer/13427/

https://www.bitdefender.com/consumer/support/answer/2393/

You can also submit the sample to Bitdefender via the Report form. This helps Bitdefender Labs adjust heuristics and reduce future false alerts. Should you wish to report this detection as a false positive, head to the link below:

https://www.bitdefender.com/consumer/support/answer/29358/

I hope this helps.

Regards