A malware deleted Bitdefender

Balogh Ádám Software

Hello,

Yesterday, before starting a game I wanted to switch Bitdefender to game mode. However, Bitdefender was not running. I tried to start it, but the icons were blank. I checked and found that the whole Bitdefender folder is missing from my Program Files, but the product was present among Programs in the Control Panel. Thereafter I redownloaded and reinstalled it. All my settings were gone.

It immediately found a threat: Winlogui.exe was present, which is a trojan. Today I switched on my computer in the evening and got two errors about missing DLLs. I found in the logs that they were deleted by BitDefender from my system32 folder: winscomrssrv.dll and StartupCheckLibrary.dll together with their corresponding tasks: WDI\SrvHost and Application Experience\StartupCheckLibrary. They are also true positives. Why did Bitdefender allow them to be installed into my Windows directory? When? During boot time? What could I do to prevent it? I found no other malware on my system.

Balogh Ádám Software

Update: I found something by using Farbar Recovery Scan Tool that was not detected by BitDefender but seems to be a malware: task called Windows Error Reporting\winrmsrv and corresponding file winrmsrv.exe. I read somewhere that this is an infection that attacks removal tools: https://forums.malwarebytes.com/topic/22981-infection-that-attacks-removal-tools/