Bitdefender's Advanced Threat Defense Keeps Blocking "whoami.exe". What To Do?

BPTacoDefender

Bitdefender's Advanced Threat Defense keeps blocking "whoami.exe" and is doing this every 4 minutes throughout today. The software states that whoami.exe is blocked and disinfection successful but I keep getting this every 4 minutes.

Please advise. Thanks.

Flexx

https://community.bitdefender.com/en/discussion/comment/320990#Comment_320990

Generate bitdefender BDsysLog: https://www.bitdefender.com/consumer/support/answer/1922/

Generate bitdefender support tool logs: https://www.bitdefender.com/consumer/support/answer/1733/

Generate bitdefender connectivity logs: https://www.bitdefender.com/consumer/support/answer/9689/

Share the logs & your query with bitdefender support team by dropping them an email at [email protected]

The support team will reply back to your query within next 24-48 hours excluding weekends.

Regards

Alexandru_BD

Hello @BPTacoDefender,

Based on your description of the situation encountered, I would recommend contacting the Technical Support Teams, as more information might be required to troubleshoot this. You can get in touch with our engineers by choosing one of the contact methods available here:

https://www.bitdefender.com/consumer/support/help/

I don't think we will be able to resolve this on the forum, because we don't know exactly why the notification behaves this way and what whoami.exe is doing. The engineers may also request logs from the device for accurate diagnosis.

Regards

Flexx

Additionally, whoami seems to be a legitimate microsoft windows file.

More information can be found in below stated link

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami

Regards

Sharcs

https://community.bitdefender.com/en/discussion/comment/320656#Comment_320656

I just had the same file blocked by Bitdefender. Here are the details:

The notification says:

Application whoami.exe has been detected as potentially malicious and was blocked.

Application path: C:\Windows\System32\whoami.exe

Command line parameters: whoami

Detection ID: SuspiciousBehavior.7E4BD9AB7C59C8B

The file was blocked while I was installing Wordpress on a local server. The local server uses XAMPP.