Hello,
I would like to report what appears to be a false positive in Bitdefender Total Security.
Advanced Threat Defense repeatedly blocked the MetaTrader 4 installer supplied by my broker (Fusion Markets), labelling it as malware. The file was blocked four times within five minutes. Notably, nothing was placed in quarantine — the file remained in my Downloads folder and only its execution was blocked.
File details:
- File name: fusionmarkets4setup.exe
- Size: 4,554,136 bytes
- SHA-256: 6CF4567CEFC2A89A32419B0E7A13BF7132C111E9BB417C60AD9C7E40A5544E12
- Source: downloaded directly from fusionmarkets.com
- Detecting module: Advanced Threat Defense
- Detection label shown in the UI: "Malicious programs" (French UI: "Programmes malveillants")
I verified the file with Get-AuthenticodeSignature in PowerShell before doing anything else. The result:
- Status: Valid
- Subject: CN=MetaQuotes Ltd., O=MetaQuotes Ltd., S=Lemesos, C=CY
- Issuer: CN=Sectigo Public Code Signing CA E36, O=Sectigo Limited, C=GB
- Valid from 2026-02-09 to 2029-02-09
- Thumbprint: 5A64A7AED24C33DED342D01D01FA5286F06DA6DC
This is a properly signed binary from MetaQuotes, the vendor of the MetaTrader platform, with a currently valid code signing certificate. MetaTrader is a widely used retail trading platform, so I suspect the behavioural heuristic is too broad and that other users are likely affected.
I have added a local exclusion as a workaround, which resolved the issue on my machine. I am reporting it so the detection can be reviewed, since an exclusion is not a satisfactory long-term answer for a legitimately signed installer.
I am also concerned that compiled MQL4/MQL5 files (.ex4 / .ex5) produced by this platform may trigger the same heuristic during normal use.
Happy to provide the sample or any further detail on request.
Thank you.
