BitDefender Antivirus


Step1: Identify support Step2: Issue Step3: Solution and contact

BitDefender Security for File Servers  




 Troubleshooting the installation

This document describes how to troubleshoot installation errors or situations in which BitDefender install wizard rolls back or you encounter an error message that stops the installation.


 The update system for virus signatures

This documents presents the update system for virus signatures used in the BitDefender products.


 Hoaxes

Describes the typical hoaxes and how to recognize them.


 I/O errors in the scan report

This document explains the I/O errors statistics included in the scan reports.


 Kaspersky Wrongly Flagged BitDefender as Malware Misidentified .dll No Cause for Alarm
On Thursday, January 18, products from competing antivirus maker Kaspersky began misidentifying a file (filecopy.dll) which is not a virus, but rather a legitimate component of BitDefender software. The confusion spread, as some other antivirus producers "took the lead" from Kaspersky and added the file to their signature databases as a virus.

As a result, this component of BitDefender was being flagged (at 14.00 local Friday 19) as:
BDS/Agent.aec.6 by AntiVir
Win32.Agent.aec by eSafe
Backdoor.Win32.Agent.aec by Kaspersky.
Backdoor.Agent.aec by Ewido
W32/Agent.AYBF by Norman

 Windows installer service could not be accessed
When attempting to install the BitDefender Management Server or the BitDefender for Windows Servers, the error "The Windows installer service could not be accessed. This can occur if you are running Windows in safe mode, or if the Windows Installers is not correctly installed" occurs.

This error prevents the installation of the BitDefender products.


  How to Install/Upgrade Windows Servers products from the Management Server Console (versions 3.3.x)
There are 2 different situations that will be discussed in this document:

  1. Install Windows Servers products from Management Console
  2. Upgrade Windows Servers products from Management Console

 V.3.3 for BitDefender Security for Windows Servers
Very IMPORTANT!
If you are using the Windows Servers products integrated in Management Server, please also read the following article.


The current article describes the V.3.3 version available for the BitDefender Security for Exchange 2000, BitDefender Security for Exchange 2003, BitDefender Security for Exchange 2007, BitDefender Security for File Servers and BitDefender Security for Mail Servers components of the BitDefender Security for Windows Servers suite.

System Requirements:

  • Internet Explorer 6
  • Operating systems: Windows 2000 SP4 + Update Rollup 1 / Windows 2003 SP1 Server / Windows 2008

 Windows network services might be stopped after Downadup removal process
Sometimes, after you ran the Win32.Worm.Downadup removal tool, you might find yourself in position of not being able to :

a) Access your network computers, printers and shares;
b) See a list of computers from your network;
c) Register and update your IP address;
d) Automatically configure your wireless adapter;



 BitDefender releases the Downadup removal tool
Short description of the Downadup/Conficker/Kido behaviour:

1. It creates files autorun.inf and RECYCLED\{SID<....>}\RANDOM_NAME.vmx on removable drives and on public network shares

2. It stores itself in the system as a DLL-file with a random name in c:\windows\system32\

3. It registers itself in system services with a random name, creating the following service:

Name: netsvcs

ImagePath: %SystemRoot%\\system32\\svchost.exe -k netsvcs

Then the worm creates the following registry entry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netsvcs\Parameters\"ServiceDll" = "[PathToWorm]"

4. The worm deletes any user-created System Restore points.

5. It tries to attack network computers via random ports, using Microsoft Windows vulnerability MS08-067. The worm then creates a http server on the compromised computer on a random port, for example:

http://[EXTERNAL IP ADDRESS OF INFECTED MACHINE]:[RANDOM PORT]

6. Upon successful exploitation, the other computer will then connect to this URL and download the worm spreading the infection.

7. Downadup then contacts several domains and tries to download additional files onto the compromised computer.



Showing articles from 11 to 20 of 25

Page 1   Page 2   Page 3