Bitdefender Free - Blocks malware but doesn't always quarantine it.

If you want to test the sample you can download it from here:

https://bazaar.abuse.ch/download/cd1bb0b84729b272e28a48cdfc22ef1f2577e4a1779a9fe871e54cf71707ded8/

In fact my purpose was only to report this Bitdefender behavior which in my opinion is not correct. It is true that it protects the PC that is not damaged but the malware should be quarantined and not left on the desktop. I put the link for any "lab" tests to find the solution to this behavior. 🙂😉

I did the test a little while ago and now it is detected, probably having updated the signatures it has finished with the new definitions and therefore it is detected and then quarantined, as always taking many seconds. The point, however, remains on the fact that when it was not in the signatures and therefore it was not detected, running it was blocked (which is very good) but it was not quarantined and remained on the desktop, instead in my opinion if detected as malicious it should be quarantined and don't stay on the desktop. 😉

Thanks!

Nunzio.

But the goal of this post is not the fact that thanks to the signature update this malware (taken as an example) is detected, the point is that when a malware is not detected by the signatures and the behavioral analysis of Bitdefender still blocks it (this is great) the malware remains on the PC and is not quarantined even if Bitdefender reports that it is a malicious application and blocks it.

Here is a new example of malware not yet present in signatures that is not yet recognized by Bitdafender Free (rightly by file protection). By executing it, the behavioral analysis intervenes by blocking the malicious app (excellent) but is not eliminated.

Because?

It should be quarantined and not left on the desktop.

Here you can find the malware sample and the evaluation on Virus total:

https://bazaar.abuse.ch/download/5466ad64faf97ff2f6cf88872406ce7891f2518c11101c0646575ef08bc9f6be/

https://www.virustotal.com/gui/file/5466ad64faf97ff2f6cf88872406ce7891f2518c11101c0646575ef08bc9f6be

Run the tests before it ends up in the AV signatures-

@mmirrakhur Were you able to test it too?

It is now in the AV signatures, as also noted on VirusTotal.

To me it stayed on the desktop. So could it just be a Bitdefender Free problem to fix?

The warning pop-up in this case only said that the application had been blocked, it did not communicate that it had been quarantined. The other time while communicating that it had been quarantined it remained on the desktop, refreshing the desktop was always on the desktop.

Another malware sample not detected in the signatures, is blocked if performed (excellent behavioral analysis) but is not quarantined (to be fixed):

VirusTotal:

https://www.virustotal.com/gui/file/e60353b37f785c77e1063ac44cba792e9ec69f27b1dc9f3b719280d5ce015cc0

malware link:

[LINK TO MALWARE SAMPLE REMOVED]

Why is it only blocked and not quarantined (see attached image)?

It is not yet in the signatures.

If it is blocked it should also be quarantined, to leave the PC clean.

It is a general discourse not only on this specific sample.

I sent the following email to the service center ... let's see if they understand the problem and solve it ...

"Good morning,

for example i did a test on this ransoware sample:

removed link with example malware

which is not yet present in the Bitdefender signatures:

https://www.virustotal.com/gui/file/bb762f2ee1e1b87d0b2a6340f2470ed895cfefc2d809f58e187f735cbc808850

Running the Bitdefender Free malware blocks it but the file remains on the desktop is not quarantined.

Let's see what they will answer me ..

It's not hard to understand ... just run some tests and see how Bitdefender Free behaves ...😀😉

I understood what happens in the free version as opposed to the paid one. In the advanced settings of the antivirus in "actions on threats" leaving the choice on "perform appropriate actions" in some cases some applications are only blocked but not put in forty (I do not know by what criteria).

In the paid version this option can be changed, while in the free version it is not. So in the paid versions you can choose to always quarantine everything, in the free version it is more automatic and some malicious applications are blocked but remain on the PC.

What do you think @camarie ?

Thank you @camarie 🙂

However, in my opinion in the free version at least this option could be left unlocked at the user's choice. 😉

Recentemente ho notato questo comportamento anche nella versione plus con un altro malware recente. Non mi piace molto. Continua a bloccarsi con vari popup, ma l'applicazione dannosa ha continuato a funzionare e sul dektop del PC. Messo su una chiavetta USB dopo l'esecuzione viene bloccato e cancellato e messo in quarantena. Questo bug deve essere corretto. Con altri AV russi gratuiti questo non accade.

Non ho avuto altre risposte a questo.

Another example of malware blocked but not removed.

https://www.virustotal.com/gui/file/d36dfa6a4b6f9b227140179c2424fe17f113e925a4bb9e8f51e304b8ef4eabf3

Even if it is indicated that it has been quarantined "Disinfection successful" open quarantine, the malware was not present in the quarantine and the file was always left on the desktop and this time also on the USB stick (I did a second test from a USB stick).

In my opinion, in addition to blocking, it should quarantine the malicious file causing the infection.

See detail image.

Quindi giusto per capire, se il file non è nelle firme, l'analisi comportamentale blocca il file e tutti gli altri file che entrano nel "gioco" senza metterlo in quarantena?

A me, facendo altri test, è capitato che il file non fosse ancora nelle firme ma dopo essere stato bloccato dall'analisi comportamentale è stato anche messo in quarantena.

Ma ho notato che questo non accade sempre e non mi è ancora chiaro perché. Se si tratta di un comportamento normale o c'è qualcosa di anomalo in alcuni casi.