safety of Bitdefender: could there be a recent file within software Bitdefender gathering data?

Theodam · 2022-07-23T06:34:40+00:00

There was an error rendering this rich post.

Hi,

MY QUESTION: is private/tmp/com.bitdefender.dmg a legitimate file from Bitdefender?

BACKGROUND: Yesterday I initiated a system scan on my MacBook, checking if spy- or malware was installed since stupidly enough I did fall for a fraud giving access for 1-2 minutes to my laptop. At one point I saw a file in exception-box from Bitdefender. Those files are excepted from the scan. It was a file from Bitdefender with 'privacy' in the name. I did make a screenshot, the name is: private/tmp/com.bitdefender.dmg

When I clicked on the file to get to know more, it just disappeared. I cant find it. That makes me very suspicious.

WHO AM I (EXPERIENCE) I am not an expert; am known with digital environments from day 1 (old man), working with computers for a long time, starting with first (wished I had that one still). So, well aware of dangers etc, known with the environment but anything but a digital expert (unfortunately, wished I was. Great to be able to create new digitality).

Kind regards,

Theo

Find more posts tagged with

Accepted answers

Alexandru_BD

Hello @Theodam and welcome to the Community!

private/tmp/com.bitdefender.dmg is a private "mount point" of Bitdefender, used to mount the iso/dmg images found during the scan. It is installed only for Bitdefender, the system does not see it installed. It has nothing to do with data collection.

For more information regarding data processing, you may consult the Privacy Policy for Bitdefender Home Solutions at the link below:

https://www.bitdefender.com/site/view/legal-privacy-policy-for-home-users-solutions.html

The document explains the personal data we collect, how and where we may use it, how we protect it, who has access to it, with whom we share it, and how you may correct it.

Should you have any questions, please do not hesitate to get back to us.

Regards

Theodam

Hi Alexandru,

Thank you. That is comforting that it is a legitimate file.

Since my stupidity to give access for a fraud to my pc for 1-2 minutes, I am trying to see if there is Spyware installed on my computer in that period.

My new question: IF the fraud was successful in installing spyware in the period he was given access by me via 'anydesk' to my pc, so it could not be seen as a threat by software Bitdefender (I approved access) <<>> is Bitdefender software then still in the position to identify the spyware as spyware, in spite of the fact that it has been installed during a period there was approval for access to my pc?

In other word: how sure can I be there is no spyware on my pc after a system scan?

I have run system scan several times now. No threat is found. I am just not sure if there is spyware gathering data about passwords etc, biding its time. And then, when I feel safe, one day I wake up to find all my accounts to be empty. So, I am wondering what kind of safety I have, what Bitdefender can find.

I hope I am clear in my text for what I am asking and what my worry is. I just dont know what to do, who to ask.

Thank you for your time.

Kind regards,

Theo Veltman

Alexandru_BD

Hi @Theodam and thanks for replying.

I'll address each point below:

is Bitdefender software then still in the position to identify the spyware as spyware, in spite of the fact that it has been installed during a period there was approval for access to my pc? - The answer is YES.
how sure can I be there is no spyware on my pc after a system scan? - You can't be 100% sure, but not any less sure than if you got some malware we don't have detection for off the internet directly, instead of via remote.

For peace of mind, the engineers can have a closer look. Follow the steps described in the article below, to generate a BDsysLog malware analysis tool:

https://www.bitdefender.com/consumer/support/answer/11198/

Then go to this link https://www.bitdefender.com/consumer/support/, scroll down to the bottom of the page and use the contact form to get in touch with our engineers and attach the logs in your ticket.

They will tell you for sure if anythink lurks inside your device, based on the information displayed by the BDsysLog.

Let us know how it goes.

Regards

Theodam

Hi Alexandru,

Txs again, man. Great. Really useful info and proposed action.

I have one problem trying to execute what you proposed: I downloaded the software for creating the blog. When I try to execute it I get a message saying:

'BDSyslog 2' kan niet worden geopend omdat Apple het bestand niet kan controleren op kwaadaardige software.

In English: ‘BDetc’ cant be opened since Apple can't check the file for malicious software. After that line it says ‘Get in touch with supplier, so they can amend their software to comply’.

What can I do about that?

Kind regards,

Theo Veltman

0645921356

Alexandru_BD

Hi Theo,

I've just learned that there is indeed a known issue with the BDsysLog tool:

Try to right click -> open in order to open the file. The developers are working on a fix.

Regards

Alexandru_BD

@johnd @Bugcrowd_Tester321 are you guys up to some pen testing? 😎

Theodam

Oh man, I am just too tired. I just saw that I tried to click on your screenprint.... DUH!@#$% So, I am now in touch with support via chat. Thanks again and have a good weekend.

All comments

Alexandru_BD

Hello @Theodam and welcome to the Community!

For more information regarding data processing, you may consult the Privacy Policy for Bitdefender Home Solutions at the link below:

https://www.bitdefender.com/site/view/legal-privacy-policy-for-home-users-solutions.html

The document explains the personal data we collect, how and where we may use it, how we protect it, who has access to it, with whom we share it, and how you may correct it.

Should you have any questions, please do not hesitate to get back to us.

Regards

Theodam

Hi Alexandru,

Thank you. That is comforting that it is a legitimate file.

Since my stupidity to give access for a fraud to my pc for 1-2 minutes, I am trying to see if there is Spyware installed on my computer in that period.

In other word: how sure can I be there is no spyware on my pc after a system scan?

I hope I am clear in my text for what I am asking and what my worry is. I just dont know what to do, who to ask.

Thank you for your time.

Kind regards,

Theo Veltman

Alexandru_BD

Hi @Theodam and thanks for replying.

I'll address each point below:

is Bitdefender software then still in the position to identify the spyware as spyware, in spite of the fact that it has been installed during a period there was approval for access to my pc? - The answer is YES.
how sure can I be there is no spyware on my pc after a system scan? - You can't be 100% sure, but not any less sure than if you got some malware we don't have detection for off the internet directly, instead of via remote.

For peace of mind, the engineers can have a closer look. Follow the steps described in the article below, to generate a BDsysLog malware analysis tool:

https://www.bitdefender.com/consumer/support/answer/11198/

They will tell you for sure if anythink lurks inside your device, based on the information displayed by the BDsysLog.

Let us know how it goes.

Regards

Theodam

Hi Alexandru,

Txs again, man. Great. Really useful info and proposed action.

I have one problem trying to execute what you proposed: I downloaded the software for creating the blog. When I try to execute it I get a message saying:

'BDSyslog 2' kan niet worden geopend omdat Apple het bestand niet kan controleren op kwaadaardige software.

In English: ‘BDetc’ cant be opened since Apple can't check the file for malicious software. After that line it says ‘Get in touch with supplier, so they can amend their software to comply’.

What can I do about that?

Kind regards,

Theo Veltman

0645921356

Alexandru_BD

Hi Theo,

I've just learned that there is indeed a known issue with the BDsysLog tool:

Try to right click -> open in order to open the file. The developers are working on a fix.

Regards

Theodam

That is a shame. I tried the right click, it didnt solve the issue.

Is there anything else I can do in order to check is something malicious is installed gathering data until a moment they will use it to clean me out, or try so. I cant keep my bankaccounts blocked for a long time...

Thanks man, I really appreciate you trying to help me.

Kind regards

Alexandru_BD

@Theodam you may contact the Support Teams directly, without having the BDsysLog. I'm not sure if they can do it without the logs, but perhaps there's a workaround for this.

Cheers.

Theodam

Thanks again, Alexandru.

I dont think they can do much without the logs. As I am sure you can understand, I am very hesitant to give access to my pc on distance.....

I just read this article of today, hoghlighting one of my worries. https://www.govtech.com/security/living-off-the-cloud-hackers-modernize-an-old-school-tactic?utm_campaign=Newsletter%20-%20GT%20-%20GovTech%20CIO&utm_medium=email&_hsmi=220544229&_hsenc=p2ANqtz-8Kn-yx-xlLYVL_5uRzyauw6Gfx-uNC5xuhPoZcYKYqbjTRMJvKbL1iCipMK6yrUVFXWrvqmNVSVOijXgtOjxHZG6JaGw&utm_content=220544229&utm_source=hs_email

Thank you very much for your time, knowledge and effort in helping me. I am really sorry the log cant be made in a Apple-environment.

Kind regards,

Theo Veltman

Alexandru_BD

@Theodam this should be resolved by now, but if the logs still cannot be collected from your end, I'm pretty sure the engineers can provide further guidance on how to achieve this.

Cheers

johnd

fantastic thanks!

Bugcrowd_Tester321

great!

Alexandru_BD

@johnd @Bugcrowd_Tester321 are you guys up to some pen testing? 😎

Theodam

Thanks Alexandru,

I have tried and it works!! The log file is created. Man, that is quick fixing. Great.

However, I tried to send the file I collected to support as you suggested twice. It wont send. The page I am using (sending an email) just not want to be send. Do you have a suggestion?

Kind regards,

Theo Veltman

Alexandru_BD

Hi @Theodam,

Glad to hear it's working as expected now.

So, have you raised a ticket using this link https://www.bitdefender.com/consumer/support/help/ ?

After specifying the nature of your request, you are prompted with 3 contact channels, as shown below:

Simply choose "send us an e-mail" and the contact form will be displayed. You may attach the logs there:

Is the attachment loading and are you receiving any error message? Try to use a different browser, or even incognito mode or a different device and see if the file can be attached this way.

You can also opt for chat and connect with a technical representative live, who can advise on the spot.

Regards

Theodam

I tried three times. One way or another sending it is blocked. It just wont send. There is no error message. The message I get (after a while) is that the check (x in the square) under the message is out of time so it is not send. I will try the chat later. Thanks again :)

Scott

Try emailing (or talk to Chat) support to let them know you're trying to upload the file, as at one time the upload from the support page was limited to a smaller file size, so support would respond with an email link that could handle larger file sizes. I don't know if the direct email link from the support site has changed since it was recently upgraded?

Theodam

Thanks Alexandru, I will try to create the log later on. Just in case the bud is fixed :)

Theodam

Thanks Alexandru,

I have tried and it works!! Man, that is quick fixing. Great.

I will send the file I collected to supprt as you suggeste.

Thanks again, man. I was (and still am a little) really worried. Nice to know that Bitdefender is and its crew is so effective and supportive in a case like this.

Kind regards,

Theo Veltman

Alexandru_BD

Anytime Theo, we are here to help and you can count on us!

I'm glad to hear the situation was resolved. Do let us know if the engineers find anything suspicious.

Have a good weekend ahead!

Regards

Theodam

Hi Alexandru, I still have to send the file. Tried to do so but cant get chat or email working. Anytime I click on those a new venster opens, where the click doesnt work either.

Theodam

Oh man, I am just too tired. I just saw that I tried to click on your screenprint.... DUH!@#$% So, I am now in touch with support via chat. Thanks again and have a good weekend.

Alexandru_BD

Ok let's try something else then. Choose the call option and you will be connected with one of our representatives. Upon your request, a ticket will be raised by the Support engineer on the spot. Following your conversation, ask the engineer to send you a message on that ticket, to which you can reply and attach the file directly from your inbox.

I am not sure exactly what is blocking the chat and contact form windows, I suspect there could be something locally, as both are working fine on our end.

Regards

Theodam

Hi Alexandru, I have been in touch with support. They have the logfile and will come back on it when they have been able to have a look at it.

By the way: on the macBook (that I brought away to be checked) they found a virus that was not easy to get rid of. Before I did do a couple of scans with Bitdefender. So, BDef didnt notice it. What to do about that?

Alexandru_BD

Hi Theo,

Glad to hear the logs were uploaded successfully.

Well, first it must be established if the virus was present before or after installing Bitdefender on the machine. Secondly, the antivirus protection consists in several layers. The security modules are designed in a specific way, so that IF a defense fails, another one takes its place.

A false negative occurs when an antivirus fails to detect an infection. Bitdefender detects about 99.51% of viruses in the wild, so it is possible, although very unlikely, that a virus will get past its filters. This happens mainly because new malware is released continuously and there is a time gap between the moment a virus is created and the moment we add detection for it. Other situations concern PUA/PUP software installed with other bundled programs. In such cases, when you agree to a license agreement to load the bundled pack, security solutions don’t mark the program as malware because it’s installed with the user’s consent.

I trust our engineers' best judgement to provide further clarity and advice regarding this.

Regards