Question Bitdefender service blocked by ASR rule

[Zartarra]

Hello,

I am testing Bitdefender Total. I used local GPO's to config my system including MS Defender policies. This morning I got an interesting warning from a MS Defender ASR rule. It seems that a Bitdefender service is blocked because it use a signed driver that is being exploited.

I contacted Bitdefender support. So I am waiting what the have to say.

Anyone else with the same error?

Kind regards,

Zartarra

 

[LennyFox]

@Zartarra thanks for sharing

As far as I know, the ASR rules only apply when Microsoft Defender still is your active antivirus. Probably your group policy settings prevent MD from being deactivated.

I just installed BitDefender Free without problems with Malware Defender on MAX (using Configure Defender to enable all ASR rules).

On a site note: the Online Protection part checking on misused certificates and certificates of non trustworthy issuers (or issuers with misused certificates) is very chatty. I disabled that setting (has a few false positives because it also blocks websites connections of web services using certificates of issuers with a past problem, e.g. Github). Browsers have sufficient (HTTPS) certificate protection.

 

[ErzCrz]

@Zartarra thanks for sharing

As far as I know, the ASR rules only apply when Microsoft Defender still is your active antivirus. Probably your group policy settings prevent MD from being deactivated.

I just installed BitDefender Free without problems with Malware Defender on MAX (using Configure Defender to enable all ASR rules).

On a site note: the Online Protection part checking on misused certificates and certificates of non trustworthy issuers (or issuers with misused certificates) is very chatty. I disabled that setting (has a few false positives because it also blocks websites connections of web services using certificates of issuers with a past problem, e.g. Github). Browsers have sufficient (HTTPS) certificate protection.

User WHHL or H_C to enable ASR rules and not Configure Defender since your not using Microsoft Defender as your AV. You can then Whitelist if needed inside WHHL or H_C.

 

[Zartarra]

Thanks for the suggestions .

I set the ASR rule in audit mode and I have reinstalled Bitdefender. Lets us see what this does .

 

[Zartarra]

The answer from Bitdefender was rather poor. The suggestion was to remove the other anti-virus product (MS Defender in my case).