Bitdefender's Advanced Threat Defense Keeps Blocking "whoami.exe". What To Do?
Bitdefender's Advanced Threat Defense keeps blocking "whoami.exe" and is doing this every 4 minutes throughout today. The software states that whoami.exe is blocked and disinfection successful but I keep getting this every 4 minutes.
Please advise. Thanks.
Best Answer
-
Generate bitdefender BDsysLog: https://www.bitdefender.com/consumer/support/answer/1922/
Generate bitdefender support tool logs: https://www.bitdefender.com/consumer/support/answer/1733/
Generate bitdefender connectivity logs: https://www.bitdefender.com/consumer/support/answer/9689/
Share the logs & your query with bitdefender support team by dropping them an email at bitsy@bitdefender.com
The support team will reply back to your query within next 24-48 hours excluding weekends.
Regards
Life happens, Coffee helps!
Show your Attitude, when you reach that Altitude!
Bitdefender Ultimate Security Plus (user)
0
Answers
-
Hello @BPTacoDefender,
Based on your description of the situation encountered, I would recommend contacting the Technical Support Teams, as more information might be required to troubleshoot this. You can get in touch with our engineers by choosing one of the contact methods available here:
https://www.bitdefender.com/consumer/support/help/
I don't think we will be able to resolve this on the forum, because we don't know exactly why the notification behaves this way and what whoami.exe is doing. The engineers may also request logs from the device for accurate diagnosis.
Regards
Premium Security & Bitdefender Endpoint Security Tools user
2 -
Additionally, whoami seems to be a legitimate microsoft windows file.
More information can be found in below stated link
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami
Regards
Life happens, Coffee helps!
Show your Attitude, when you reach that Altitude!
Bitdefender Ultimate Security Plus (user)
1 -
I just had the same file blocked by Bitdefender. Here are the details:
The notification says:
Application whoami.exe has been detected as potentially malicious and was blocked.
Application path: C:\Windows\System32\whoami.exe
Command line parameters: whoami
Detection ID: SuspiciousBehavior.7E4BD9AB7C59C8B
The file was blocked while I was installing Wordpress on a local server. The local server uses XAMPP.
0
