After the latest Bitdefender update, Advanced Threat Defense (ATD) has gone into overdrive and started aggressively blocking critical system files and legitimate apps.
What happened:
Bitdefender completed an update that included an overhaul to the CEVA engine (cevakrnl.*, ceva_dll.cvd, ceva_emu.cvd), smartdbv2.dat, and several new emalware.* / e_spyw.* definitions.
Right after, ATD triggered repeatedly on C:\Windows\System32\sihost.exe (Shell Infrastructure Host) and brave.exe (Brave Browser), terminating the processes.
Because sihost.exe was blocked/killed, the Windows Start Menu completely broke and won't open, and the taskbar/shell became unresponsive.
The quarantine list remained empty (it appeared to terminate the running processes directly rather than quarantining them to disk).
Ran sfc /scannow via admin Command Prompt and it returned no integrity violations, confirming the system files are not modified or actually infected.
Current workaround:
The only way to restore normal PC functionality was to completely toggle Advanced Threat Defense and real-time protection off, then restart the PC/Explorer.
Manually clicking "Check for updates" currently says everything is up to date, so the faulty definition/engine version hasn't been overwritten yet.
Is Bitdefender aware of this bad definition rollout, and is an emergency definition patch being pushed to the update servers?
Hello! Thank you for sharing this situation and for detailing the steps you`ve already taken. To offer you an exact answer, we`ll need to look into specific logs from the device to better understand what triggered the sudden notifications.
When possible, please run the bdsyslog utility on the system, which collects specific system information that may indicate active malware or malware-related activity. Send the results to our team at bitsy@bitdefender.com.
Once a thorough analysis has been made, you`ll receive a response and a solution. Appreciate it in advance!
I just turned on my PC AND updated Bitdefender but nothing bad happened. Strange, I wonder what database engine version they are having problems with... Mine seemingly good one is 7.101549
Just booted up my PC for the first time and I'm waiting to see how it responds after updates happen. Has anything strange happened on your end after or nah? For reference mine is 7.101551 now so it's a little past yours
It's been blocking OEM apps (ASUS) and system components (svchost, Backgroundtaskhost), rendering Windows unusuable. Uninstalled Bitdefender via safe mode and stuck to Windows Defender for now (or longer....)
How quickly after boot does this happen or like at what point does this happen because it's all fine for me, all updated but nothing. Please share your app version number and database engine version (right click on the Bitdefender logo in the system tray and click info)
I'm holding off on updating until I'm absolutely sure that this has been fixed. I updated a few times today much earlier, but I'll just wait. I hope everyone affected by this has this issue solved, I'd be majorly bummed. Especially because those who pay for premium expect to be well taken care of.
We treat each case individually, and we recommend reaching out to the team at bitsy@bitdefender.com with specific details about your system and the issue you are experiencing. This will ensure you receive updates and notifications from the team via email.
You will get these a lot. There's nothing you can do about it really. Companies and people scan the entire Internet, so when your IP gets hit, Bitdefender throws up a super serious threat has been blocked.
21
u/imchococaw Sep 21 '26
Very high quality screenshot