Troubleshooting

This section explains how to use the Bdsyslog tool to submit suspicious files for malware analysis.

If your computer appears to be infected but Bitdefender does not detect any malware, please follow the steps below. Be sure to provide us with the following information, so that we can fully understand the cause and provide you with a quick solution:

This section explains what to do when Bitdefender reports a legitimate file as being infected (false positive).

Bitdefender strives to reduce false-positive reports to a minimum. However, these reports are commonly due to bad programming practices (e.g. applications that change the Master Boot Record, add run registry entries, change system files without the user’s confirmation or execute custom macros in office applications, etc.).

When an application is wrongfully detected, try adding exclusions as explained in In-policy exclusions.

Should the exclusions fail, you need to send us the detected file(s) as described below:

Some files may not be detected by Bitdefender even if they are malicious. This is called a false negative and usually occurs when the malware uses new (unexplored) techniques.

In order to promptly resolve this issue, we kindly ask that you send us the malware file(s) as described below:

If you suspect that your computer is infected but Bitdefender does not detect any threats, please read this article.

In this section you will learn how to submit sample files and websites for analysis, using the online submission form.

This section describes how to troubleshoot On-access scanning on Bitdefender Endpoint Security Tools for Linux.

sudo /opt/BitDefender/bin/bduitool get ps

Product version: 6.2.20.63
Last succeeded update: 2018-05-07 at 19:05:28
New product update available: no
Signatures version: 7.75906
New signatures update available: yes
Installed scan type: Full
Installed scan type fallback: None
Currently used scan type: Full
Features:- 
Antimalware status: Off

The interaction between Bitdefender Endpoint Security Tools (BEST) and Google Drive may result in performance issues on endpoints during scheduled scans. To avoid these issues, you need to add exclusions or make certain configurations in GravityZone Control Center.

This article discusses several scenarios and the possible solutions on Windows and macOS endpoints.

BEST for Windows and Google Drive

On Windows, you may encounter different scenarios while using Google Drive.

Scenario 1. BEST scans the G: drive every time a full scan runs on endpoint

Issue

Bitdefender Endpoint Security Tools (BEST) scans the same files, multiple times, over the internet. This action results in downloading files offline and consuming disk space.

Solution

To exclude the G: drive from scanning, you must add a folder exclusion with the following details:

• Path: G:\

• Modules: On-demand

The On-access module still provides full protection for that location.

When adding the exclusion, pay attention to Google virtual drive naming behavior:

• If drive letter G: is available, Google Drive uses it to map the virtual drive

• If G: is not available (already in use), Google Drive uses the first available drive letter.

If Google Drive uses a different drive letter, make sure you also add that letter as an exclusion.

To learn how Google Drive assign mount letters to the virtual drive, refer to this article from Google.

Scenario 2. BEST scans the local Google Drive cache

Issue

This action makes the files keep resyncing or getting downloaded offline taking space on the endpoint.

Solution

Create folder and process exclusions as described below.

Folder exclusion

• Path: %LOCALAPPDATA%\Google\DriveFS

• Modules: On-demand, On-access, ATC/IDS

Process exclusion

• The path from your system configuration for GoogleDriveFS.exe

• Modules: On-access, ATC/IDS

Scenario 3. BEST scans the Google Drive drive every time the application is started and the drive is mounted

Issue

This action causes resource consumption and it happens because the Device Scanning option is active in the policy (for details, refer to Antimalware On-Demand).

Possible solutions

• Disable the Device Scanning option in the policy. As long as On-access scanning is functional on the endpoint, this action does not affect security.

• Disable USB storage devices scan in Device Scanning. As long as On-access scanning is functional on the endpoint, this action does not affect security.

• Set a size limit for the Do not scan devices with stored data more than (MB) option (for example, 100 MB).

• Enable the Display alert pop-ups option in the General > Notifications settings of the policy. This action allows the user to choose whether to scan the attached drive or not.

  

Scenario 4. I want to block Google Drive when using the Device Control module

Issue

Google Drive causes resource consumption when having the Device Control module active on endpoint. This happens because GravityZone matches the Google virtual drive to the External Storage > Other category.

Solution

To block Google Drive, you can choose one of these options:

• Block the entire External Storage category. To do this, open the External Storage category and, for Permission, select Blocked.

  

• Block only the Other category in External Storage. Follow these steps:, select Custom under Permission, and select Blocked for Other.

  1. Open the External Storage category.

  2. For Permission, select Custom.

  3. Under Customer Permissions, go to Other and select Blocked.