Ransomware behavior detected - TiWorker.exe

Question

Hello,

I received a new notification from my Bitdefender Total Security 2019 this morning:

Now, I know TiWorker.exe is part of the Windows system process, and this could be a possible false positive on my security. I'm just wondering why this has manifested all of a sudden. Has something changed recently?

The file it encrypted don't seem to be anything out of the ordinary, but I'm no windows expert

Any information that could be provided will be greatly appreciated,

Kind Regards,

Answer 1

I got the same problem today (Nov-23rd).

Under Windows Update, I see a failed patch update today.

Every time, I retry to install the earlier failed patch, Bitdefender is flagging it as Ransomeware behavior.

I am feeling this issue may be caused by the windows update "2018-11 Security Update for Adobe Flash Player for Windows 10 Version 1709 for x64-based Systems (KB4477029) - Error 0x800706be"

Hope it helps.

Answer 2

Since the file belongs to Windows (the O.S of our system), it seems logical to start here.

After, before coming forward, "to accuse", it is necessary to make a logical diagnosis:

1. The file belongs to Windows
2. a) Is it Windows?
3. b) Is it the antivirus (who reported it)?
4. c) Is it a ransomware?
5. Common point of impacted users: Bitdefender
6. a) Bitdefender seems to be the cause
7. No reporting from users with another antivirus?
8. a) Bitdefender is very likely to be the cause
9. Creation a discussion group at Bitdefender
10. Bitdefender confirms that it comes from them?
11. a) NO: it's a ransomware.
12. b) YES: it's a false positive. Corrective in development.

https://forum.bitdefender.com/index.php?/search/&q=Tiworker

Posted 6 hours ago => https://forum.bitdefender.com/index.php?/topic/80108-tiworkerexe-bloqu%C3%A9-et-identifi%C3%A9-par-bitdefender-comme-ransomware-remont%C3%A9/&tab=comments#comment-287422

Piouf is a YES ^^ we are saved ! lol

Bitdefender is responsible

It's not Windows.

This is not a ransomware.

One step after another ;)

Is only one brain sufficient? Why are we here ? ^^

It is with a minimum of dialogue that a conclusion is established.

Thank you all for your participation and thank you for creating this discussion group here.

Thank you Smeed for you links.

WARNING : the diagnosis and informations remains short, stay alert. Safety first ! ;)

I let you close the discussion group if needed :)

Cordially

Answer 3

I wonder why all you BitDefender user don't post in BitDefender forum...

Seems that this is a false positive detection and perhaps you all should reply to this post: https://forum.bitdefender.com/index.php?/topic/80076-tiworkerexe-blocked/&do=findComment&comment=287342

Also see: https://forum.bitdefender.com/index.php?/topic/80108-tiworkerexe-bloqu%C3%A9-et-identifi%C3%A9-par-bitdefender-comme-ransomware/&do=findComment&comment=287423

Answer 4

Did you ever get a solution to this?

Answer 5

Have you run Windows Security and Malwarebytes?