- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Trying to install the newest Version of the Arc Driver (32.0.101.8247) Bitdefender stopped the installation due to an malicious Command-Line.
I downloaded the driver using the Intel Graphics Software and after that i downloaded it from https://www.intel.de/content/www/de/de/download/785597/intel-arc-graphics-windows.html
Both times the Installation was stopped.
the Message i get from Bitdefender is:
Schädliche Befehlszeile erkannt.
vor 2 Minuten
Funktion:
Virenschutz
Der App C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe wurde eine schädliche Befehlszeile übergeben und sie wurde blockiert. Ihr Gerät ist wieder sicher.
Befehlszeile: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand "cABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBdACQARQB4AHAAZQBjAHQAZQBkAEMAaABlAGMAawBzAHUAbQAgAD0AIAAnADEANQA3ADQAMwA3ADAANAA4ADUAMgA1ADQAOAA4ADQAMAAyADEANQAxADIANwAwADIAOQA5ADkAOAA2ADcAMQA0ADYAMQA3ADEAMQAxADQAMQA0ADgANwAwADAANwAyADIANQAwADIAOQAzADkAOAA3ADAAOAAxADEAMgA3ADAAMAAwADMANAA3ADEANgA5ADQAOAA5ADQAMQAzADYAMwAnACkADQAKAA0ACgAkAGUAeABwAGUAYwB0AGUAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgB1AG0AZQByAGkAYwBzAC4AQgBpAGcASQBuAHQAZQBnAGUAcgBdADoAOgBQAGEAcgBzAGUAKAAkAEUAeABwAGUAYwB0AGUAZABDAGgAZQBjAGsAcwB1AG0AKQANAAoAJABzAGYAeABBAHIAZwBzACAAIAA9ACAAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARQBuAHYAaQByAG8AbgBtAGUAbgB0AFYAYQByAGkAYQBiAGwAZQAoACcAcwBmAHgAYwBtAGQAJwAsACcAUAByAG8AYwBlAHMAcwAnACkADQAKAA0ACgAkAHMAdQBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBOAHUAbQBlAHIAaQBjAHMALgBCAGkAZwBJAG4AdABlAGcAZQByAF0AOgA6AFoAZQByAG8ADQAKAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAEYAaQBsAGUAIAAtAFIAZQBjAHUAcgBzAGUAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewANAAoAIAAgACAAIAAkAGgAYQBzAGgAIAA9ACAARwBlAHQALQBGAGkAbABlAEgAYQBzAGgAIAAkAF8ALgBGAHUAbABsAE4AYQBtAGUAIAAtAEEAbABnAG8AcgBpAHQAaABtACAAUwBIAEEAMgA1ADYADQAKACAAIAAgACAAJABzAHUAbQAgACsAPQAgAFsAUwB5AHMAdABlAG0ALgBOAHUAbQBlAHIAaQBjAHMALgBCAGkAZwBJAG4AdABlAGcAZQByAF0AOgA6AFAAYQByAHMAZQAoACcAMAAwACcAIAArACAAJABoAGEAcwBoAC4ASABhAHMAaAAsACAAWwBTAHkAcwB0AGUAbQAuAEcAbABvAGIAYQBsAGkAegBhAHQAaQBvAG4ALgBOAHUAbQBiAGUAcgBTAHQAeQBsAGUAcwBdADoAOgBIAGUAeABOAHUAbQBiAGUAcgApAA0ACgB9AA0ACgANAAoAaQBmACAAKAAkAHMAdQBtACAALQBlAHEAIAAkAGUAeABwAGUAYwB0AGUAZAApACAAewANAAoAIAAgACAAIAAkAHAAcgBvAGMAIAA9ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABzAGYAeABBAHIAZwBzACAALQBXAGEAaQB0ACAALQBQAGEAcwBzAFQAaAByAHUADQAKACAAIAAgACAAZQB4AGkAdAAgACQAcAByAG8AYwAuAEUAeABpAHQAQwBvAGQAZQANAAoAfQANAAoAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoAIAAgACAAIAAkAG0AcwBnACAAPQAgACcAVABoAGUAIABpAG4AcwB0AGEAbABsAGEAdABpAG8AbgAgAGMAYQBuAG4AbwB0ACAAcwB0AGEAcgB0ACAAYgBlAGMAYQB1AHMAZQAgAHQAaABlACAAZgBpAGwAZQAgAGkAbgB0AGUAZwByAGkAdAB5ACAAYwBoAGUAYwBrACAAZgBhAGkAbABlAGQALgAgAFQAaABlACAAcABhAGMAawBhAGcAZQAgAGEAcABwAGUAYQByAHMAIAB0AG8AIABiAGUAIABjAG8AcgByAHUAcAB0AGUAZAAgAG8AcgAgAG0AbwBkAGkAZgBpAGUAZAAuACAAUABsAGUAYQBzAGUAIABkAG8AdwBuAGwAbwBhAGQAIAB0AGgAZQAgAGQAcgBpAHYAZQByACAAYQBuAGQAIAB0AHIAeQAgAGEAZwBhAGkAbgAuACAASQBmACAAdABoAGUAIABwAHIAbwBiAGwAZQBtACAAcABlAHIAcwBpAHMAdABzACwAIAB2AGkAcwBpAHQAIAB3AHcAdwAuAGkAbgB0AGUAbAAuAGMAbwBtAC8AcwB1AHAAcABvAHIAdAAgAGYAbwByACAAYQBzAHMAaQBzAHQAYQBuAGMAZQAuACcADQAKACAAIAAgACAAWwB2AG8AaQBkAF0AWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAkAG0AcwBnACwAJwBFAHIAcgBvAHIAJwAsAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4ATQBlAHMAcwBhAGcAZQBCAG8AeABCAHUAdAB0AG8AbgBzAF0AOgA6AE8ASwAsAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4ATQBlAHMAcwBhAGcAZQBCAG8AeABJAGMAbwBuAF0AOgA6AEUAcgByAG8AcgApAA0ACgAgACAAIAAgAGUAeABpAHQAIAAxAA0ACgB9AA=="
Link Copied
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This seems like a false positive from Bitdefender. The Intel Arc installer uses PowerShell scripts for setup, which can trigger security tools. Try temporarily disabling real-time protection or adding the installer to Bitdefender’s exclusion list, then re-enable protection after installation. Intel may also need to submit the file to Bitdefender for whitelisting.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I absolutely agree with you on this. I would never listen to a workaround that starts with "temporarily disable security tools to install", that is the worst advice from a vendor I have ever heard. We had a user try to install the same gfx executable on their Dell laptop from a mirror Intel download link and it was flagged by both Crowdstrike and Taegis/Sophos after the user tried to install. We informed the user that we would need to clean it up and then have them use only verified drivers from either Dell Command Center or straight from the Dell support portal after entering their Service Tag.
I would like to think that Intel would pull the driver due to it being flagged by MANY security tools, and redesign the driver package to install without issues like this, not suggest the workaround that is given in these forums.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same issue with Kaspersky, 'gfx_win_101.8247.exe' blocked as suspected of being 'TROJAN - PDM:Exploit.Win32.Generic'
That's downloading using the 'www.intel.com/content/www/us/en/support/intel-driver-support-assistant.html link etc. & the 'Intel Graphics Software' Window app.
I'm sure it will get resolved soon, by either party involved.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Blackscorp81,
Thank you for reaching out about the Bitdefender false positive detection when trying to install Intel Arc driver version 32.0.101.8247. I understand how concerning it can be when your antivirus software flags a legitimate driver installation.
I can see that you've downloaded the driver from both the Intel Graphics Software and our official Intel website, and Bitdefender is blocking the PowerShell command line execution during the installation process. This appears to be a false positive, as Olivia mentioned, since Intel Arc installers do use legitimate PowerShell scripts for the installation process.
Here are my recommendations to resolve this issue:
Clean Installation: If you're still experiencing issues, I recommend performing a clean driver installation:
- Boot into Safe Mode and run DDU to completely remove your current Intel graphics drivers
- Restart your system normally
- With Bitdefender temporarily disabled, install the fresh Intel Arc driver 32.0.101.8247
- Re-enable Bitdefender protection
Follow the instructions here: How to Use the Display Driver Uninstaller (DDU) to Uninstall a...
Let me know if the issue still persists afterward.
Best regards,
Dean R.
Intel Customer Support Technician
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I also have the same issue (Windows 11 25H2) on my Alienware laptop. It was flagged and deleted by Norton Anitvirus during installation (See Attached). I attempted to install it using the Intel Driver & Support Assistant as well as downloading it from the Intel driver page.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
F-Secure all so Flags it as a virus.
More specifically as a trojan:
Category: MalwareTypeTrojan-Downloader Platform: W32AliasesTrojan.downloader.variant, Trojan.downloader.jstrojan-downloader, Trojan downloader, Trojan.downloader., trojan-downloader.w
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Blackscorp81,
I wanted to follow up on the previous message regarding your inquiry. Have you had a chance to review it? If you have any questions or need further information, please let me know.
Hi Gavsky23, Olivia342
Thank you for reporting this issue with Kaspersky flagging the Intel Arc driver as a false positive. I can see you're experiencing the same problem as Blackscorp81, but with a different antivirus solution, which confirms this is a widespread false positive issue affecting the latest driver version 32.0.101.8247.
To provide you with dedicated support for your specific configuration, I'd recommend creating a new support thread for your case. Please create a new support thread so I can provide you with more detailed assistance specific to your setup.
Best regards,
Dean R.
Intel Customer Support Technician
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So.... After Uninstalling with DDU and trying to install new version i got tons of Problems. Bitdefender even Quarantined some Files and my Display was no longer working properly. Had to restart the machine multiple times.
The Solution to me was to manualy extract the driver-installer using WinRAR instead of using the self-extracting File i got from the download. The driver itself works great. But there surely i something wrong with the self-extracting Archive u provide. All other older Versions work like a charm. An a self-extracting Archive should always work the same, since its just an extraction-process with the automatic launch of the driver installer after extraction. Should NEVER turn back a positive AV-Result.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My concern is whether it is an honest false positive by Bit Defender, or is it a code injection by a malicious third party. Regardless, I really appreciate you posting how to bypass it, skipping the PowerShell code. Which is why I'm suspicious. If the Powershell code served a purpose in the install, the install would fail when run from setup.exe. It would be missing something. Either a registry entry, or file from Intel's servers. Just a thought.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Blackscorp81,
I'm really sorry to hear about the difficulties you experienced during the driver installation process. Having Bitdefender quarantine files and cause display problems requiring multiple restarts must have been incredibly frustrating, especially when you're just trying to update your graphics drivers.
I'm glad you found a workaround using WinRAR to manually extract the installer, that's excellent troubleshooting on your part! Your observation about the self-extracting archive being the issue is very valuable, and you're absolutely right that this shouldn't trigger antivirus detection.
This information is crucial for our development team to understand what's causing the false positive with the self-extracting executable. To help them analyze this issue properly, could you please provide a screenshot of the Bitdefender quarantine notification or detection message you received? This will show exactly how Bitdefender is flagging the installer.
If you still have the quarantine logs or detection details in Bitdefender, those would be extremely helpful as well.
Your feedback about previous driver versions working without issues confirms this is specific to the 32.0.101.8247 release, which helps narrow down the investigation.
Thank you for taking the time to share your workaround - it will definitely help other users experiencing the same issue while we work on a permanent solution.
Best regards,
Dean R.
Intel Customer Support Technician
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I also had this problem today with Bitdefender stopping the install of 32.0.101.8247 on Windows 11 on an Asus NUC.
This was doing the install from https://www.intel.com/content/www/us/en/support/intel-driver-support-assistant.html
Bitdefender had this in it's Notifications section:
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After looking the Bitdefender logs a little closer i did find the same File Quarantined multiple times. Every time i Tried to install this Driver.
Here is the Screenshot you requested
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Blackscorp81,
Thank you so much for taking the initiative to investigate the Bitdefender logs more closely and providing the screenshot. I really appreciate the extra effort you put into documenting this issue.
I can see from your screenshot that Bitdefender is consistently quarantining the same file multiple times during your driver installation attempts, which confirms the systematic false positive detection we suspected.
To help me analyze the quarantine details more accurately, could you please change your Bitdefender interface language to English and take another screenshot of the same quarantine logs? This will ensure I can provide precise information when working to resolve this false positive issue.
If you're not sure how to change the language, it's usually found in Windows Settings or Preferences menu under "Language" or "Interface Language" options.
Your documentation is extremely valuable for getting this false positive resolved and having it in English will help expedite the process.
Thank you again for your patience and thorough investigation of this issue.
Best regards,
Dean R.
Intel Customer Support Technician
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
me to i have the same problem but with AVG antivirus, I think the issue is with the intel driver itself
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I ran into this today as well. Personally, I trust BitDefender far more than Windows Defender or Intel, for that matter; especially considering the U.S. government holds roughly a 10% stake in the company.
BitDefender flagged it clearly: “Malicious command line detected.”
Intel needs to address this immediately. And to everyone else: never trade security for convenience, whether online or in real life... especially not just to silence a notification icon.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Blackscorp81 ,
I'm following up on behalf of my colleague @DeancR_Intel regarding his previous request. Kindly provide a screenshot in English at your earliest convenience so we can coordinate this matter internally.
For other users @username_alreadytaken @analytic1 @RDB212 @0x20Man experiencing similar issues, you may choose to monitor this thread for updates. However, I strongly recommend creating a separate thread for each individual case. This will help us address your concerns more effectively and keep the discussion organized, ensuring that your details don't get mixed up with the original poster's information. Thank you for your understanding.
Best regards,
Randy T.
Intel Customer Support Technician
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Bitdefender and Norton are detecting it as a false positive; the security companies should evaluate the analysis. Kaspersky doesn't have this problem; the update installed successfully without being identified as a virus.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Blackscorp81,
As you have been unresponsive, I will proceed to close this thread. If you wish to continue the discussion or need further assistance, please feel free to create a new thread. This will help us provide focused support and ensure your concerns are addressed effectively.
Hi bishop,
Thank you for sharing this to our community.
Best regards,
Dean R.
Intel Customer Support Technician
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page