Atera agent found malicious by Bitdefender

OMG this is bad. Same here!
All our managed servers are unreachable. No way to access the servers anymore. How on earth is this possible! Support says to exclude Atera folders for now and there is no ETA when this if fixed.

Same here, where else do we post this for more visibility ? Sending a tech to all these sites for reinstall/whitelisting would be costly. We are using the integration between these company's so this shouldn't be a surprise.

Excluded Atera agent and directories in bitdefender gravity zone policies.
restored atera agent from bit defender quanrantine
Rebooted servers.
Atera agent still not working !!!
Tried to reinstall agent and it failed
Support said to wait for an email with an update.
Frankly, I find that Atera is very relax knowing that this is happening. May we call it a major issue.
All servers down and unreachable
All SNMP devices monitored by server agent unreachable.

further update from ATERA - They have opened a case with BitDefender to get to the bottom of it.

as we've all done - Exceptions of Program Files folders under, additionally, the agent's working Temp folder and then we need to reinstall/reset the service.

Additional Folder:
> C:\Windows\Temp\AteraUpgradeAgentPackage

-> cd "C:\Windows\Microsoft.NET\Framework\v4.0.30319"
-> InstallUtil.exe "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
** Wait for the process to finish successfully, then run in CMD: **
-> sc stop ateraagent && sc start ateraagent

14:00 Update: We have just completed our work in getting the servers back online. It has cost us 6 hours of this work day (and a part of yesterday evening when we noticed it) to fix it.
We are happy that the issue is resolved but a little more background info would be appreciated and is beneficial for understanding and essential for context and building consensus.

This is the second time this happens. Earlier this year Atera was deleted by Windows defender.
How is this even possible? What is causing Bitdefender to flag Atera as Malware? Has it something to do with the notorious: OpenHardwareMonitorLib.sys? Is Atera still using this?
What has been done to prevent this in the future? Are there things we, the customers can do?

@frank.pietersma thanks for this.

just in process of doing this.

it's frustrating that comms were poor. i'm sure there are some out there who have had everything deleted, was only 20 odd endpoints for me.

"it's resolved" isn't an answer

Was this incident caused by Atera or BitDefender?
I mean if this was caused by BitDefender then maybe worth to let them answer the question(s).

I am using different Antivirus products than BitDefender but quite interested in the outcome. I had no alarms on my site.

Hey Atera, What's the fix? Some of our systems come back online when we reinstall the agent others do not. We have found that we can remote into the workstations since it's using the Atera supplied remote even though the workstation is offline. We need some guidance here on what to do. We are having to touch every system again.

Commenting here for further proof that this is affecting multiple people. BD Removed 50 Endpoints from our network. Has there been any update on an official solution, or do we have to do all the leg work and use the fix provided by @frank.pietersma?

Bitdefender has released an signature update which will not flag Ateraagent.exe anymore as malware.
So even without the exclusions it should work again! Still it will be a lot of work to get everything back online :-(
We noticed during the process we could still connect to agents with Splashtop even though the agents seemed down in Atera. That saved us from a lot of traveling time to customers.

Just to be on the safe side for now we will leave the exclusions in place.
When using Gravity zone, under "policies" you can configure "Exclusion lists" Here you can specify the exclusions.
These exclusion lists can then be added to the policies you've made for your customers so you only have to create the exclusions one time. In the policy you can select them under "Antimalware - Settings - Exclusions from configuration profiles"

Would like to hear back from Atera/BitDefender on this. We need to be able to re-deploy agents easier. I am getting some restoration failures when trying to restore from within BitDefender, which means having to do a re-install of almost all my agents

Creating AV exclusions is a huge no-no for us.

What if the Atera agent IS now malicious, and was infected way up the distribution chain?

As of 2100 EST, 11/1/23, some machines are allowing a reinstall, some it just disappears. (I do wish the Atera Agent installer had some useful information. Side note- can we make the warning go away upon installation? If we have to GPO-install this everywhere we're not going to have enough phone lines (or staff) to support the freak out.

Just wanted to drop in to confirm that the issue can still crop up - I've had limited impact this morning (ticket raised via support@atera.com), so I'm hoping it stays at the four servers.

When an agent gets reinstalled - will the previous agent need to be removed from the portal or will the historical data/logs transfer over to the new install?

EDIT: the block happened yesterday before the root cause was identified (national holiday), the alert only popped up this morning in Atera.