Acer firmware update file triggers bitdefender

Petersl

Hi everyone,

When trying to update my acer laptop firmware bitdefender blocked it labeling it as Gen:Application.Venus.Iscflashx.Cy3eG2@aqfqJYeG , when scanning the file with bitdefender it finds nothing only when running it.

I downloaded the acer bios update file from the official acer website.

I've uploaded the file to virus total and there 1 out of 68 flagged it as "Suspicious.low.ml.score", bitdefender on virus total however labeled it as "undetected".

I submitted it to bitdefender by e-mail as the https://www.bitdefender.com/consumer/support/answer/29358/ from gave me an error trying to upload it saying "your request could not be registered".

Is this indeed a false positive? As virus total does have 1 out of 68 flagging it?

Petersl

Hi everyone,

Bitdefender support sent me an reply:

"Hello Peter,

Thank you for your patience and I hope my email finds you well.

Our Malware Research Team has finished analyzing your case.

Vulnerable drivers which are found outside their original scope, are detected as Application.Venus.<X> (PUA/PUP) by Bitdefender Endpoint Security Product because they might be used with malicious intent.

As such, if there is a legitimate need to use a driver outside it's original scope on a specific computer within the custom network, you can configure the security policies to exclude the driver by path (e.g.) on the specific target computer. You can simply press the "Restore" button in the notification area. If the Bitdefender Quarantine settings are set as default, an exception will be set after restoring the registry key.

Should there be anything else I can assist you with, please let me know.

Have a great day!"

However this file is not a driver file but a firmware update and I ran it on the supported laptop, the file was also not quarantined by bitdefender only when running the file it created a temp file and that temp file was quarantined by bitdefender.

When running a scan on the firmware update exe file bitdefender finds nothing but when running the file it blocks something in the temp, so is this now a false positive or not?