Insync 1.3.19 update detected as virus by Bitdefender 2018

Bugs and issues
#1

Not sure what the deal is but I woke my Windows 10 (1703) desktop out of a sleep and was presented with a notification that Insync had been updated to 1.13.19. Two seconds later Bitdefender notifies me that it’s detected threats and is disinfecting. Bitdefender killed Insync and the logs show the following files were infected with Gen:Atc4.Detection:

c:\users\*\appdata\local\temp\insync\_meeprqtmp\app.bak\res\html\accounts.html
C:\Users\*\AppData\Local\Temp\Insync\_meeprqtmp\App.bak\uninstall.exe
C:\Users\*\AppData\Local\Temp\Insync\_meeprqtmp\App.bak\res\sacred\dfcf10ee5a49492b834a241490c85c16.lnk
C:\Users\*\AppData\Local\Temp\Insync\_meeprqtmp\App.bak\res\sacred\ae47fd01c9eb24d73b7590c4fcaebc2f.lnk
C:\Users\*\AppData\Local\Temp\Insync\_meeprqtmp\App.bak\res\sacred\7c374024875a398b5fbae1f28febdc53.lnk
C:\Users\*\AppData\Local\Temp\Insync\_meeprqtmp\App.bak\res\sacred\6fea79982667b3491043f9c0dd60a329
c:\users\*\appdata\roaming\insync\app\uninstall.exe
c:\users\*\appdata\roaming\insync\app\lib\insync-cef.exe
c:\users\*\appdata\local\temp\insync-upd-1.3.19.36173\updater\res\html\js\onboarding.js
c:\users\*\appdata\local\temp\insync-upd-1.3.19.36173\updater.pyc
c:\users\*\appdata\local\temp\insync-upd-1.3.19.36173\updater\res\html\js\app.js
c:\users\*\appdata\roaming\microsoft\windows\start menu\programs\startup\insync.lnk
c:\users\*\appdata\roaming\insync\app\insync.exe

I’m assuming it’s a false positive. I couldn’t find much information regarding Gen:Atc4.Detection. I’m not sure how to proceed. I guess I’ll try removing them from quarantine and see if Insync is functional. Maybe a fresh install would be better? Thanks.

#2

I believe I have the same problem. Insync no longer operating and I see it listed as a blocked application.

#3

So I removed the files from quarantine and started Insync. Tested by adding and removing files, then checking on the google drive web interface. Everything seems to be working again. Haven’t restarted my computer yet though. I’ll report back if anything profound happens. Thanks.

#4

Same problem here:

Antivirus

Bitdefender moved a threat to quarantine. File name: C:\Users(remoevd)\AppData\Local\Temp\Insync_r4i2b3tmp\App.bak\res\sacred\330778ba4fb5fe1a6be391e54a98d6ee.lnk. It is recommended that you run a System Scan to make sure your system is clean.
RestoreDelete

Infected file detected
Yesterday at 8:46 AM

Feature:
Antivirus

Bitdefender moved a threat to quarantine. File name: c:\users(REMOVED)\appdata\roaming\microsoft\windows\start menu\programs\startup\insync.lnk. It is recommended that you run a System Scan to make sure your system is clean.

Infected file detected
Yesterday at 8:43 AM

Feature:
Antivirus

The item c:\users(REMOVED)\appdata\roaming\insync\app\lib\insync-cef.exe was restored at user request.

Bitdefender moved a threat to quarantine. File name: C:\Users(REMOVED)\AppData\Local\Temp\Insync_r4i2b3tmp\App.bak\uninstall.exe. It is recommended that you run a System Scan to make sure your system is clean.

Infected file detected
Yesterday at 8:47 AM

Feature:
Antivirus

The item c:\users(removed)\appdata\roaming\insync\app\insync.exe was restored at user request.

#5

Same thing happened on my laptop as well. Both desktop and laptop are running latest version of windows 10 pro with bitdefender total security 2018. On both computers bitdefender detected the insync update as Gen:Atc4:Detection, quarantined insync related files and blocked the app. Restoring the files from quarantine seems to allow insync to resume functionality. I haven’t had additional bitdefender interventions after the file restoration

I’m assuming it’s a false positive. However, I could use some reassurance to put me at ease. Especially following the recent CCleaner malware outbreak.

EDIT: Bitdefender on laptop was set to ‘take proper action’ and so deleted the ‘infected’ files. I had to download the windows insync installer and re-install. Thankfully all the settings were retained so after the reinstall it worked properly without hassle.

#6

I just saw the 1.3.21 update and installed it without interference from Bitdefender. My original settings were restored.

#7

Auto update 1.3.22 was again detected as malicious and blocked by bitdefender on both my laptop and desktop PCs. To date, insync updates are the only apps blocked by bitdefender, in the years I’ve been using bitdefender. So clearly bitdefender has issue with recent insync update behavior or code. This issue is very annoying as I then have to download the full installer and reinstall.

I also don’t see release notes for 1.3.22?

#8

Ok, so attempts to reinstall 1.3.22 have failed. See attached screenshot. There is no insync.exe in the folder being referenced. Insync is not listed in the windows programs either. There appears to be no way to remove the botched update, and the fresh installer seems to want to simply update existing files rather then do a clean installation.

What is the solution to this mess? I’ve completely disabled bitdefender and it hasn’t helped with the reinstall. This is such a waste of time.

insync install fail

EDIT: Just realized something, why is insync putting any exe files in my appdata folder? It makes no sense to put the entire insync program in the appdata/roaming. Why isn’t insync going in programs(x86) like every other program? I’m guessing this is why bitdefender is blocking it.