How to stop certain updates from disabling the protection for up to 5 min?

Windows 10, Desktop PC

Regular Bitdefender updates take place in the background without any disruption. Few years ago, Bitdefender started running updates every so often that without any warning disable the firewall and the whole protection for 2-5 minutes for the update to run - and THEN show a notification that a restart is required. This happens about 2-3 times a month.

I have raised this issue with Bitdefender few times already, saying that I CANNOT allow my computer to be unprotested for any period of time, let alone 5 minutes which is what happened few days ago.

Each time I got reply that "this can't be changed". I'm sorry but this is a self-centred nonsense. A clear design flaw in the update process with no consideration for the serious security risk it creates. Since this type of update requires a restart anyway, it should send this notification BEFORE it begins and run it ONLY during the restart.

I tried to enable Windows firewall - but I can't, with Bitdefender on.

Every time this update disables my Bitdefender protection, I get an immediate notification from Windows to turn the firewall on. When I raised this issue again after the last such incident with support, I said that if they don't change this update to manual and only during a restart, I WILL turn on Windows firewall when it happens and I can hopefully catch it - which could interfere with the update process.

There is NO WAY I will allow my computer ever again to be completely unprotected for 5 minutes just because it was easier for the developers to design this update in such a detrimental for the user way.

If this is unresolved and Bitdefender can't guarantee 100% protection of my computer with no interruptions and run all updates in the background or during the restart only - I will have to find another internet security provider. Bitdefender's disregard for such a serious security risk they are creating is incomprehensible and frankly, flabbergasting, given the very nature of their product.

Any ideas?

Find more posts tagged with

Accepted answers

All comments

Gjoksi

Hello.

I believe that @camarie, who works at Bitdefender as Principal Software Developer and/or @Alexandru_BD, who works for Bitdefender and/or @dvsls, who works at Bitdefender as QA Manager, can give you more insights on this matter.

Regards.

Alexandru_BD

Hello,

In newer versions of Windows, shut down or sleep is no longer equal to restart, due to performance considerations of the operating system. So unless the user explicitly restarts the system, he would no longer be able to replace the update files as he used to do before. That's about what was wrong with deferring service restarts until the machine is restarted the way they used to be. That's why a new flow appeared, so that Bitdefender can allow updates to be carried out when necessary and ensure the devices are restarted properly.

There's a notification which informs the user that Bitdefender services will restart. This means that Windows will also give the user a message that he is no longer protected in the few seconds that Bitdefender services stop and start. It is important, however, that the user sees the pop-up from Bitdefender before seeing the message from Windows, because otherwise it will seem like there is a problem with the antivirus, and that's not really the case here.

What actually happens is that some modules are turned off for a very short time while the patch is being applied. However, Bitdefender has many systems that back up each other and provide protection during that short timeframe

By design, the developers would not make an update system that would leave customers vulnerable in any way. 🙂

I hope this brings some peace of mind.

Regards

acumen777

Hello

Thanks for your reply.

However, your explanation and description of what happens are not entirely correct in terms of my experience.

To begin with, the restart is not an issue. I don't allow automatic restarts for any updates (which is my prerogative as the end user) - Windows, Chrome, HP Wolf Security, Bitdefender or anything else - so I always get a notification that Restart is Required. When I see it, I finish the work I'm doing, close all my programs and manually restart my PC. Not an issue at all.

The issue is that when this update starts running, it immediately and without a warning disables my Bitdefender prompting a Windows alert to activate the firewall and antivirus protection as my computer is not protected. I then get a pop up "progress" window that shows 84% and doesn't change at all.

You said that only some modules are turned off for a very short time while the patch is being applied.

That interruption lasts between 2-5 minutes. I wouldn't call it "a very short time" which would be more like 30-60 seconds. Two to five minutes is an unacceptably long gap in the system protection posing a serious security risk, as far as I'm concerned.

While as you say, only some modules are turned off, they definitely include the firewall which is the main level of protection - hence my Windows alert to turn on the firewall.

So I keep watching it, glued to the progress window with growing anxiety as time passes by, with one eye on the clock. One minute, two minutes, three, four….five….and there is no way for me to stop it. Finally, the pop up window disappears, I get my Bitdefender widget back on the screen and a notification that Restart is Required - which will not happen until I do it manually when I am ready.

If restarting the user's computer to finish the update is your main concern to the point of forcing the update install that disables the firewall - it's not relevant in cases like mine where the user disallows automatic restarts. So while not achieving its objective (immediate restart), it creates a security risk that is counterproductive.

Given the above, I'd like to ask if you could please adjust this update process to give a notification that Restart is Required and commence only at the beginning of the manually activated restart (while there is still an internet connection) and complete through this process.

While I now understand the reason for these updates, this hasn't put my mind at ease as I still consider a 2-5 minute gap in my system protection a serious security risk; plus now, based on your explanation, in fact, unnecessary.

I would appreciate your thoughts.

acumen777

hi - thank you 😊

regards

Alexandru_BD

Hello,

I'll share a few insights posted by Camarie on a similar topic a while ago.

In a nutshell, it works like this:

update is downloaded and prepared to install by detecting which files needs to be replaced and which one of these are in use.
it detects if a product reconfiguration is needed; for example, when switching a subscription, changing a license, migrations from other older products and overall changes signals then need for a full product reconfigure.
it detects which patches, if any, needs to be run at various stages of update: pre install, post install, and, if a restart is needed, post restart.
if a file is in use and loaded by an executable (or it is an executable itself), that executable is marked for restart (the executable, not the entire Windows) so that the updated file; in this example with the tray icon, which is loaded and displayed by the application agent (bdagent.exe) dissapears, it means bdagent.exe or a dll loaded by bdagent needs to be replaced; for this to happen, a special command is issued to bdagent to stop itself, the file or files are replaced with the updated version, then bdagent.exe is restarted at a later time.
if an operating system component (usually a driver, such as the firewall driver) needs to be updated, this usually needs restart by the operating system design, so this is the most common case when a Windows restart is asked; other cases might include migrations from old versions of product; components loaded by Windows Explorer (these might be solved only by restarting explorer instead of full OS restart, but there are so many cases where things can go wrong, such as removable disks not unmounting, external programs having components loaded in explorer and not behaving correctly etc. so a Windows restart is preferable).
the protection is not disabled during an update; if a protection component needs to be replaced and it is not possible without a restart, then a Windows restart is asked and its replacement occurs very early in the reboot process; even so, protection service and a handful of critical defense are present nonetheless!
other cases for restart might include components loaded in third party applications, such as Outlook, Thunberbird, Chrome, Firefox etc. and restarting them can prove dangerous since the process is external to Bitdefender and we have no real full control over it so that we do not affect that external application, and instead we ask the Windows to restart and let the application cleanly close itself as normal.
the notification from Windows regarding protection does not exactly mean "You are unprotected"; Windows displays this by doing two things:

1. offer a programmatic way to protection solutions such as ours to register as a WSC (Windows Security Center) provider; cases when Windows might display this can be when uninstalling such a registered product (obviously), when the communication component itself needs an update and is restarted for a brief period (meaning not the protection, but the executable in charge with WSC communication is briefly off).

2. communicating with these providers executables for various state information - I believe this is the case when such a notification occurs. Simply restarting the agent, for example, or even services loading product functionality does not mean the device drivers directly interacting with Windows are off, just that they work using their current configuration until the product is updated and back running, when the interaction is resumed.

The notification coming from Bitdefender is important to let the user know it is not a problem with the product itself, and also indicating there is a maintenance operation to be done. If an update is carried out automatically and the user does not see anything, as in the described case, the update event is still recorded and available on the Notifications panel.

To make a long story short; the drivers are always on (unless Windows reboot and they are updated, but the protection driver is still on); the backend product (services) update can temporarily restart for reload/reconfiguring, this meaning the drivers will continue momentarily without interacting with these functionality services (meaning they will continue to work using the last known configuration - but even if this changes after restarting services, these will inform the drivers about the changes and continue accordingly), and the application (front end and user processes) update will cut off momentarily the interaction with the user, but the backend and drivers are still running.

Of course, the whole story is even more complex than that - this mainly covers the product restart - but there are signatures and sensors, for example; such components have their own update process and we are interacting only to control the update flow (automatic or ask user), starting the appropriate update commands, reload the updated versions etc. - probably one does not need to hear everything dissected to this detail level.

I hope this explains a little more about this topic.

acumen777

Thanks for your reply.
I understand that there is a high level of complexity in this process, and I don't necessarily need to know all the details.

I can only comment on what I can see on my computer screen which I have already described earlier. How this is aligned or misaligned with what is actually going on - I don't know.

If I understood you correctly. you claim that during this 2-5 minute disconnection of my Bitdefender, the firewall is not down for the duration of the update, but maybe for just a few seconds, and so the protection is always there.

That's not what I can see on my screen when Windows immediately shows me a warning notification to turn on the firewall as my computer is unprotected.

Furthermore, during the last such update few days ago which was was the longest so far (about 4-5 min), I opened my Windows security settings to watch what was happening there.

Sure enough, it was showing that there was no active firewall - and this status quo remained for the entire 4-5 minutes until the updated was finished.

This doesn't look to me like an interruption of only the user's interface. If that disconnect was only momentary - Windows would have changed the status the moment the firewall kicked in. That however, did not happen. So you ask me to take your word for it against the information I am getting from Windows. Logically, I can't do that. Unless Windows is so stupid that it can't see if the firewall is off or on, which is another conversation. How can you explain that?

Finally, you described in great level of detail the process - how this works. You did not address my request to make these type of updates manual, showing a notification and allowing the user to commence them when they are ready.

I'm not asking you to overhaul the entire process, just to adjust it to be more user friendly which doesn't disable the firewall, specifically. The virus protection may still be there, but it won't protect the computer from hacking - that's the job of the firewall which is much more important that virus definitions.

Windows doesn't tell me that I have no virus protection. It says that I have no firewall.

regards

acumen777

ok then. thanks for your reply.

There is no Reply option on your last post so it looks like you have closed this conversation. That's not very polite. Normally it is left up to the conversation starter to mark the issue as resolved and close the thread.

I hope that as Admin you can still read my final comment.

One final point:
It took a lot of time and effort on my part with phone calls to your customer support and several emails, where a customer support agent who clearly wasn't able to address my enquiry, didn't escalate it to the developers as per my request and her original confirmation. Instead, she kept repeating that this is how it works and can't be changed with no explanation, effectively leaving me with no answer or escalation avenue. A dead end.

That's not a satisfactory level of support, to say the least.

Only then I thought of posting this issue on this forum (which I have never used before), someone mentioned your name and you have replied.

It shouldn't have come to that, especially that I asked for a prompt reply considering switching my internet security provider due to my unresolved security concerns. I should have received this information and advice via a reply to my first support ticket.

Now I close this thread.