First, what is Bitdefender?
Bitdefender is a security company. Its detection runs in its home products and in its business products, where an endpoint agent applies the rules set by the company. Bitdefender Labs analyzes the files and websites that people report.
Bitdefender can mark a website as dangerous, phishing or fraudulent, and a file as a threat. When the verdict is wrong, the product blocks your page or deletes your file until Bitdefender Labs corrects it.
Who can't reach you right now
Where it's used, and who shares it
AV-Comparatives lists these consumer products as using the Bitdefender engine. Each one has its own settings and allowlists, so the false-positive counts can differ, but a fix at Bitdefender is the place to start.
EmsisoftUses Bitdefender engine
G DATAUses Bitdefender engine
TencentUses Bitdefender engine
Total DefenseUses Bitdefender engine
VIPREUses Bitdefender engineThese engines are independent from Bitdefender. If they flag you too, each one needs its own request:
Kaspersky →
ESET →
Avast / AVG →
Microsoft Defender →How to tell if you're flagged
Bitdefender Link Checker (bitdefender.com/en-us/consumer/link-checker). Enter your URL to see how Bitdefender rates it. We found no public lookup for files.
VirusTotal. Scan the URL or file and find the BitDefender row. The same scan shows the rows of the products that share the engine, and whether other engines flag you too.- A clean test machine. Install a trial in a virtual machine, update it and open your site or run your file.
- User reports. Ask affected users for a screenshot of the Bitdefender event. It shows the detection name, and Bitdefender asks for that screenshot in the report.
Asking Bitdefender to fix it
Collect the details
Write down the detection name exactly as Bitdefender shows it. Take a screenshot of the Bitdefender event, because the form asks for one. For a website, copy the full URL. For a file, keep the file itself.
Check that it is a mistake
Scan your server and your scripts for injected code, and rebuild files from clean source. Bitdefender says many false positives come from bad programming practices, such as changing the MBR, adding Run keys, changing system files or using Office macros. If your software does any of these, say why in the Description.
Report a website
Open the official form at bitdefender.com/consumer/support/answer/29358. Under Select the category, choose False Positive. Fill in Full Name and E-mail, then set Sample type to URL. Enter the full URL and add a Description. Attach the screenshot of the Bitdefender event, solve the captcha and click Submit. You need no account. The form does not ask for a company email address, so a personal one is fine. A phishing flag on a website has no file to send. Say what the site is, who owns it and what each form on the page collects. Business customers use the business form at bitdefender.com/en-us/business/submit instead.
Website flagged as phishing
Select the category: False Positive
Full Name: Alex Example
E-mail: name[at]example[.]com
Sample type: URL
URL: hxxps://example[.]com/page
Description: hxxps://example[.]com is the website of our company,
Example Ltd. Bitdefender blocks it as phishing.
We own the domain and run the site ourselves. The
only form is the customer login, and it sends data
to our own server. The site has no downloads.
Please review the verdict.
Screenshot: bitdefender-event.png
Report a file
Use the same form and choose False Positive. For Sample type, choose File. Under Attach a file, upload the file. The upload limit is 25 MB. Enter the Detection name exactly as Bitdefender shows it, and add a Description. The form also has a Sensitive files checkbox. Attach the screenshot of the Bitdefender event, solve the captcha and click Submit.
File flagged as malware
Select the category: False Positive
Full Name: Alex Example
E-mail: name[at]example[.]com
Sample type: File
Attach a file: example-app-setup.zip
Detection name: <name exactly as Bitdefender shows it>
Description: This file is the installer of our product
Example App 2.1. Bitdefender detects it as a
threat. We built it from our own source. The
official download page is
hxxps://example[.]com/download. Please review
the verdict.
Screenshot: bitdefender-event.png
Wait for the fix
Bitdefender says: "Once confirmed, false alarms are corrected within hours." Bitdefender treats the information you send as confidential and uses it only for anti-malware analysis.
Check the result
Enter your URL in the Link Checker again, and scan it on VirusTotal. Look at the BitDefender row and at the rows of the products that share the engine. Ask affected users to update their product and try again.
Other ways to report
Bitdefender explains its own rules for false positives on these pages:
- Report a False Positive or False Negative detection to Bitdefender Labs
- Resolving legitimate applications detected as threats by Bitdefender
VirusTotal's list of vendor contacts gives this address for false positive reports to Bitdefender. Use it when the route above does not work for you. Put the full URL and the link to your VirusTotal report in the message. A personal email address is fine.
[email protected]