Help Needed - Total Security '16 - Quarantine And Exclusion + Manual Firewall
I installed Bitdefender Total Security 2016 yesterday (on Windows 10 Pro x64) and since then I've been running into all kinds of issues on matters that I took for granted on 1st-tier security solutions so I am wondering whether it is merely that I am missing something (thus the interface needs some cleaning) or whether they are actual issues (which should be sorted ASAP). For what it's worth I am leaning on "both". In either case, any help/pointers would be GREATLY appreciated.
Firstly, once installed it started silently scanning my system and coming across various false positives and auto-deleting them, which is understandable and acceptable on its' own, taking the better safe than sorry approach.
Trouble no.1 arose when I visited the quarantine to restore them only to find it completely empty!
After stumbling around the interface I found them on the "Events" log, together with the Restore and Delete buttons.
However, since there was no "Restore & Exclude" option offered, pressing Restore would result in promptly triggering another scan which would obviously result in a new deletion of the file. To make matters worse, I could not find any switch to temporarily turn off A/V protection so as to keep it from triggering upon restoration of the file (at least neither when right-clicking the B icon on the notif. bar nor in the program's main window.
Thus far, the only method I have found that sticks is adding the entire folder than contained the file in exceptions, restore the file in question and then edit said exception to change it from excluding the entire folder to just exclude the file.
HOWEVER, I found out that the exclusion only works as long as the file remains in that folder. Moving or copying the file somewhere else results in it being picked up and deleted again which is wreaking havok on both my local and my off-device, NAS-based backups, meaning that, in my case, in order to completely resolve the issue I would need to add three exceptions for every false positive that the A/V finds and removes.
Issue no.2 is with the Firewall. I am of the opinion that a firewall should have an "Interactive Mode", that is, asking me whether to allow a program for network access but at the same time, informing me what said program is, what it does and whether it should have network access. Looking into the firewall settings offered no such visible option.
Again after searching around the interface I found "Paranoid Mode" (a term I am not very fond of TBH) under general settings but that still has two, rather serious shortcomings.
The first is that, true to its' name, this option switches the firewall to full-manual, asking you about every single detail (like whether a program to which you already allowed TCP access should also have UDP) but without offering any insight on what said program is or what it would have done were it in Autopilot mode.
The second is exactly that; enabling "Paranoid Mode" completely disables Autopilot" for the entire suite.
I do like my security suite detecting whether I am watching a movie or playing a game and handling things in a silent, semi-automatic way like, for instance, silently handling updates and deferring on which action to take on detected incidents until after I'm done with the movie/game and asking me then.
It appears that in its' current state the suite only caters to the two extremes, it either goes full-auto, not notifying me or asking for my permission on anything or, goes full-manual and asking me about every little detail.
I recognize that my wording may allude to me being certain that these are all missing features of the suite but in truth I am currently working under the assumption that at least some of the things I mention are implemented in some way but I cannot find them, otherwise I would have posted this in the " FEATURE REQUEST" sub-forum.
However, in the case that all points raised above are indeed missing from the suite I would request that a Moderator moves this to the appropriate sub-forum.
TL;DR:
- Auto-deleted files should appear under Quarantine instead of only finding them in the "Events" window.
- There should be a "Restore & Exclude" option for false-positive quarantined/deleted files.
- Excluding a false positive from detection should exclude the file in general, not just the specific instance in that specific folder it currently resides
- There should be visible, easily accessible switches to temporarily disable protection, ideally one for each module and preferably with a duration timer/until reboot options.
- Firewall should have a semi-automatic/semi-manual "Interactive Mode" where it asks the users for Yes/No access to the network for a program and informs them what said program is/does. (*)
- "Interactive Mode" should not disable "Autopilot" for the remaining modules, especially for functions like automatic updates and optimizations of the security suite and the rest of the system.
(*) Nice-to-have features:
- In Interactive Mode, the firewall should should not differentiate between communication protocols but should ask permission for Incoming and Outgoing connections separately. Allow means allow for all protocols but for a said connection type.
- Another, nice-to-have, option would be to temporarily decide what to do, like "temporarily allow/block access for this session but ask me again next time".
- Recognize 2nd-tier browsers that are based on 1st-tier ones. For instance, I am using "Cyberfox", an Intel/x64-specific build of Firefox. The suite doesn't recognize it and as such, doesn't include it in the optimization routines.
