nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Child Item

Bitdefender Won't Scan Password Protected Files [Explanation]

Teksonik

I did a full scan on this system and received the message that 1024 files were skipped because they are "password protected". They are .svg files which can contain malicious code. Is there a reason for skipping the files? Someone reported that Malwarebytes scanned the folder without issue although I can't confirm that.
See images:

Find more posts tagged with

full system scan problem

password protected files

Comments

Alexandru_BD

Hello,

Finding a few, or even hundred password-protected system files during a full scan is completely normal.
Software developers, the operating system, or apps (like Microsoft Store packages) often lock internal data or system modules with a password or system-level encryption to prevent tampering, reverse engineering, or corruption. You can find more information on password protected files here:

https://www.bitdefender.com/consumer/support/answer/1976/

In regard to your concern, a locked archive cannot execute code or infect your system on its own while it remains encrypted. If you ever decide to extract or open such a file, Bitdefender's real-time protection will instantly scan the extracted contents before they can run.
In short, these password protected files came pre-installed with your operating system or reputable software, so they are standard and safe to ignore.

I hope the information is helpful.

Regards

Teksonik

Thanks but from your link:

"Password-protected files found during a scan are typically safe to skip and ignore". Keyword there is "typically" as opposed to definitely.

Alexandru_BD

Password-protected files are using strong encryption and can only be accessed by knowing the passwords.
To put things simple, even if such a file contains malware, it's jailed forever unless you know the password to unlock that archive. And even if you open it and try to execute what's inside, ATD will detect suspicious behaviour.
Advanced Threat Defense continuously monitors the applications and processes running on your computer. It monitors suspicious activities such as copying files to important Windows operating system folders, executing or injecting code into other processes, multiplying them, changing the Windows registry, or installing drivers.
The antivirus can't look into those files because it doesn't have the capability to decrypt or inspect the contents of encrypted archives (like .zip, .rar, or .7z files) without the password, which is normal.

Teksonik

I tried to upload one of the files in question but the file format is not supported. It is an .ilv file:

"An .ilv file is most commonly an interface layout vector data file created by IBM ILOG Views (now managed by Perforce), which stores graphical panels, user interface components, and 2D layouts for network and visualization applications.

IBM ILOG / Rogue Wave Views: Stores dynamic view specifications, interface layouts, and graphic descriptions for C++ visualization tools".

I don't see any indication that BDTS has scanned any of the files although I'm not sure if they are ever "opened" or uncompressed during use.

They are part of Image-Line's FL Studio program and its ZGame Editor Visualizer plugin (free demo download available at Image-Line.com).

I'm sure they're safe but it does seem like a really easy way to deliver a malicious payload on systems that are not protected.

Alexandru_BD

I think the only way that could happen is with the user unknowingly partaking the attack. Because like I said earlier, a password-protected archive cannot execute the malware inside it by itself. If the user genuinely cannot decrypt or extract the archive, the payload inside remains inert. The password protected files that already come with the OS, or with genuine software that you downloaded, are completely safe. It is only when you receive a password-protected file from a doubtful source that you need to question its legitimacy and actual purpose.

Yes, attackers can use password-protected ZIP/RAR/7z files because encryption can prevent email gateways and antivirus engines from inspecting the contents before delivery. As far as I know, the usual attack chain using this tactic usually look like this:
The victim receives an encrypted archive. The attacker also supplies the password, often in the email/message itself or on a linked webpage. The unsuspecting victim extracts it. Inside is something deceptive such as an .exe, s.cript, shortcut, disk image, or document designed to trigger another stage. The victim opens it, or a vulnerability in the application processing it is exploited.
From there, it's going down the rabbit hole and good luck if you don't have a good antivirus installed…