nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Child Item

ATC4.Detection viruses

Sikorsky77

i am facing suddenly of an "atc4.detection" viruses that send dozen of programs , folders , .dll , etc.. in quarantine which is considered as a false positive

i restored the quarantine , but unfortunately some files are not restored mainly because the folder of the files are deleted. its seems that atc4.detection quarantine restoration is an known issue of BitDefender without any efficient and sustainable solution since 2018.

this kind of false positive restoration issue is not the first time i encountered that decrease my trust on the product.

I've been using BitDefender for more than 15 years and I've been recommending it for years to people who ask me for my opinion on performances and qualities of the product and I have to say that I'm more and more inclined to tell them that it's not a good investment.

Find more posts tagged with

false positive

Comments

Alexandru_BD

Hello,

ATC4.Detection is associated with Bitdefender’s behavior-based protection, namely the Advanced Threat Defense module, meaning the detection can be triggered by suspicious actions performed by a process rather than by a conventional malware signature alone. For this reason, I would not recommend assuming that all of the detections are false positives or adding broad exclusions until the affected files have been analyzed.

Since you mentioned that a large number of files were quarantined suddenly and that some of them cannot be restored because their original folders no longer exist, I think this case should be investigated by the Support team. In particular, the incomplete quarantine restoration is important to examine separately from the detections themselves. Please contact Bitdefender Support using the link below and provide them with the relevant detection notifications/logs, the names and paths of the affected files, and, if possible, a few samples of files you believe were incorrectly detected. This will allow the technical and malware research teams to determine what triggered the detections and whether a correction is required.

https://www.bitdefender.com/consumer/support/help/

If the files are confirmed to be legitimate, an appropriate exception can then be applied without unnecessarily weakening protection for other applications. Given the number of files involved and the restoration issue you described, I would also avoid deleting anything further from quarantine until the case has been investigated.

Regards

Sikorsky77

Hello unfortunately i didn't keep the log (list of file in quarantine because i restored it) , i have only 4 files i can't restore because they are temporary and stored in %temp% directory which is deleted when i close my pc

to complete information's : this issue came from a software named Environment Launcher Pro that permit to launch a list of add-on application for simulator (Microsoft Flight Simulator 2024, X-Plane 12) the ****** contains 25 actions to do . The editor tld us that the software is tested under different ant-virus tool

this software was downloaded 2k time and we are only the 2 users having this problem , a user with Windows 11 Defender and me

———————————————————————————————————————————————————————————————-an answer the editor post to the Windows 11 Defender

Important Announcement regarding False Positives in Environment Launcher Hey everyone, I wanted to give you a quick and honest update about why Windows Defender occasionally flags the app as a "Trojan" and tosses it into quarantine.

Why is this happening and what's with this loop?
The core job of Environment Launcher is to spin up multiple other programs, often with administrator privileges, so you don't have to click the UAC prompt 15 separate times. To antivirus software, especially Microsoft's machine learning models, this behavior naturally looks suspicious. Because of what the app does, it is way more prone to triggering false alarms than almost any standard program.

Every time you guys report a block, I immediately submit the file to Microsoft. And here is where the loop gets annoying: their automated scanners reply saying the file is 100% clean and they can't find any malicious code. As a result, they close the ticket without updating the database, until the heuristics randomly trip over it again on someone's machine. I'm attaching a screenshot of their official response to my latest ticket so you can see how absurd this process is from the backend.

What about the Microsoft Store and Digital Certificates?
I originally planned to bring the app to the Microsoft Store, which likely would have fixed the Defender issues for good. Unfortunately, the Store's strict policies basically ban apps whose primary function is managing UAC elevation and launching external processes. The Store simply won't let us in.

The only other way to solve this permanently would be purchasing a digital Code Signing certificate. However, these certificates cost hundreds of dollars every single year. Since Environment Launcher uses a lifetime license model rather than a monthly subscription, it makes zero economic sense. I would have to pay a hefty recurring fee every year for a project that doesn't generate recurring revenue.

How you can help (and fix this for yourself):

Submit diagnostic logs: If Defender just blocked the app on your PC and you want to help me break this loop, you can generate the diagnostic file Microsoft is asking for on the screenshot. Just open Command Prompt (CMD) as Administrator and run this command:
cd "C:\Program Files\Windows Defender" && mpcmdrun.exe -GetFiles
This will safely create a file named MPSupportFiles.cab located in C:\ProgramData\Microsoft\Windows Defender\Support. If you can grab that and DM it to me, I'll pass it straight to MS analysts.

The quickest fix right now: Simply add the whole Environment Launcher folder to your Windows Defender Exclusions. This will give you permanent peace of mind.

Verification: You can always upload the .exe to Virustotal.com yourself, independent engines will confirm it’s completely clean.

Moving forward, I will try my best to tweak the code in future updates to make it as less prone to triggering these false positives as possible.

I’m genuinely sorry for the hassle, especially to the PRO users who actually paid for the software and now have to deal with this. This is a massive headache and frustration for me too, because instead of just focusing on building new features, I have to constantly fight Microsoft's automated systems. Thanks a ton for your patience and support!

________________________________________________________________________________________________________________

i am also discussing with the editor who wrote me

Because Environment Launcher Pro handles process management and UAC elevation, heuristic scanners in antiviruses like BitDefender or Windows Defender occasionally flag it by mistake.

I’ve posted a detailed breakdown explaining why this happens, how I'm handling reports with security vendors, and how to safely add an exception here

⁠You can safely add Environment Launcher Pro to your BitDefender exclusions, or upload the file to VirusTotal.com to verify it independently.

Also, worth mentioning: these false positives happen most frequently in the first few days right after a new update (for both Free and PRO versions).
Because the updated .exe file is brand new, antivirus algorithms haven't established a reputation for it yet and tend to flag it out of pure caution until more users run it

Thanks for reporting it to BitDefender support as well! Definitely let me know what they reply with once you get an answer.
I'm really sorry for the inconvenience with this. Unfortunately, the very nature of launcher software, running other executables with administrator privileges and executing various PowerShell scripts, is inherently suspicious to modern antivirus heuristics. That's why launchers trigger false positives far more often than regular apps.
Thanks again for your patience with this, and feel free to reach out if you notice anything else during testing!

to complete , if i run each application of my ****** launcher individually i haven't BD message issue

Alexandru_BD

Hi,

This right here sums it up: "the very nature of launcher software, running other executables with administrator privileges and executing various PowerShell scripts, is inherently suspicious to modern antivirus heuristics."

You could try to report this as a false positive detection to Bitdefender Labs. Use the form available at the link below to submit a sample of this launcher software and see what they think about it. If all is well they might just whitelist it so you won't have to do all these tweaks to avoid detection.

https://www.bitdefender.com/consumer/support/answer/29358/

I hope this helps.