Bitdefender Behavioral Scanner Alerts

Hello Fungus,

BitDefender Behavioral Scanner is a HIPS-based scanner (HIPS = Host Intrusion Protection System). It doesn't use signatures, it doesn't use blacklists, it doesn't use any predefined whitelists either, it just looks at what a certain process is doing along the way and if ANY suspicious things happen, that application is temporarily blocked and the user is asked for permission.

A HIPS scanner looks at process activity for any of the following:

- code/DLL/thread injection

- system hooking

- process/memory manipulation (like overwriting another process' memory)

- system file activity (like overwriting critical system files, or a more exact example that I encountered: when something creates autorun.inf files on all partitions, which is a very common way for malware to spread)

- and other suspicious activity

- other few details HERE, or on Google

This matter has been discussed a few times before of this forum!

So, basic lines:

- BD shows in that message the field "Product name" from the application's properties. Of course, for all Windows processes, you will see Microsoft Operating System (go figure...)

- BitDefender Behavioral Scanner doesn't care who owns that process, doesn't care who created it, it just cares about what it does. And there are a lot of legit applications that take the above-described actions.

- BitDefender products didn't have this kind of scanner in the past. It was introduced in 2009 versions. For a long time, even on this forum, there were users that were asking for such a module, and it was implemented

- most importantly: HIPS scanners are subject to WRONG alerts. They can't be called False Positives, since they don't use signatures or any other kind of scanning.

This module should be used by advanced users who can make a difference between what's legit and what isn't. It can significantly increase the protection level, but also the number of alarms. Who can't handle this, please don't use this module (it's the reason why it's disabled by default in the first place).

I will pin this topic. Any future topics about this issue will be closed and redirected to this one.

Cris.

hmm,BitDefender Behavioral Scanner is a HIPS-based scanner . It doesn't use signatures, it doesn't use blacklists.but it is arelly good one.

but the modus operandi of this sampleWere not identified by behavioral scanner and Intrusion detection, why ??

Hello Mr.00,

First of all, please write your posts using the default formatting. Putting all text on the center makes it difficult to read and follow the ideas. Thank you.

About your question: Behavioral Scanner looks for specific things in the behavior of a process. If those things don't appear, or the results aren't conclusive enough to deem the file as suspect, Behavioral Scanner won't block the application from running. This also doesn't mean that the application is clean.

Behavioral detection is very tricky, and under no circumstances it can provide 100% accuracy. It's impossible to detect all malware, whatever method you use. So failing to detect malware is just plain normal. Nothing can ever replace user's experience and you always should be careful what you run on your system.

Cris.

I told you, behavioral and heuristic scanning is tricky. What seems obvious to you might not be so obvious to an automated software algorithm.

Besides, the fact that another behavioral engine detected it doesn't mean anything at all. behavioral engines are not identical and use completely different algorithms. So it's normal that a sample might get caught by one and missed by another. Another sample might get caught by BitDefender and be missed by other engines.

It's just a matter of perspective, approximations and statistics.

Cris.

behavioral required for the conduct of the virus, which was not previously detected during the operation BitDefender

This is what I wanted to clarify

Jesus, you said that 3 times already! What exactly didn't you understand from the explanations I wrote above? Maybe I wasn't clear enough about something and I should explain it again...

Cris.

OK, let's start from the beginning, maybe this time you will understand.

Behavioral scanner monitors and analyzes, in realtime, what an application is doing. If a certain application is doing a certain combination of actions in a certain period of time, then the application is marked as suspicious and temporarily blocked by the Behavioral Scanner. Otherwise, the application is left to run.

The rules used by the BitDefender Behavioral Scanner and other behavioral scanners are NOT the same! Every behavioral engine uses different algorithms and different rules by which they determine if an application is suspicious or not.

So the fact that BitDefender Behavioral Scanner didn't react on a certain application, but other behavioral engines did doesn't mean too much. There are also cases when BitDefender Behavioral Scanner blocks an application and other behavioral scanners.

Since the sample is already detected by the antivirus engine, there's no need to submit it again for analysis.

Also, please try to put your ideas in order and write continuous sentences. It's hard for me to understand what you're asking.

Cris.

The behavioral engines are under continuous development, and are updated through Live Update whenever a new version is released, as I already said in post #5 in this topic.

Cris.