Bitdefender behavior during update

Excluding the flow based on update from Central, which is, indeed, not the normal update flow, it's usually (more or less, variations exists at all levels) like this:

• update is downloaded and prepare to install by detecting which files needs to be replaced and which one of these are in use
• detects if a product reconfiguration is needed; for example, when switching a subscription, changing a license, migrations from other older products and overall changes signals then need for a full product reconfigure
• detects which patches, if any, needs to be run at various stages of update: pre install, post install, and, if a restart is needed, post restart
• if a file is in use and loaded by an executable (or it is an executable itself), that executable is marked for restart (the executable, not the entire Windows) so that the updated file; in this example with the tray icon, which is loaded and displayed by the application agent (bdagent.exe) dissapears, it means bdagent.exe or a dll loaded by bdagent needs to be replaced; for this to happen, a special command is issued to bdagent to stop itself, the file or files are replaced with the updated version, then bdagent.exe is restarted at a later time
• if an operating system component (usually a driver, such as the firewall driver) needs to be updated, this usually needs restart by the operating system design, so this is the most common case when a Windows restart is asked; other cases might include migrations from old versions of product; components loaded by Windows Explorer (these might be solved only by restarting explorer instead of full OS restart, but there are so many cases where things can go wrong, such as removable disks not unmounting, external programs having components loaded in explorer and not behaving correctly etc. so a Windows restart is preferable)
• the protection is not disabled during an update; if a protection component needs to be replaced and it is not possible without a restart, then a Windows restart is asked and its replacement occurs very early in the reboot process; even so, protection service and a handful of critical defense are present nonetheless
• other cases for restart might include components loaded in third party applications, such as Outlook, Thunberbird, Chrome, Firefox etc. and restarting them can prove dangerous since the process is external to Bitdefender and we have no real full control over it so that we do not affect that external application, and instead we ask the Windows to restart and let the application cleanly close itself as normal
• the notification from Windows regarding protection does not exactly mean "You are unprotected"; Windows displays this by doing two things:

1. offer a programmatic way to protection solutions such as ours to register as a WSC (Windows Security Center) provider; cases when Windows might display this can be when uninstalling such a registered product (obviously), when the communication component itself needs an update and is restarted for a brief period (meaning not the protection, but the executable in charge with WSC communication is briefly off)

2. communicating with these providers executables for various state information - I believe this is the case when such a notification occurs. Simply restarting the agent, for example, or even services loading product functionality does not mean the device drivers directly interacting with Windows are off, just that they work using their current configuration until the product is updated and back running, when the interaction is resumed.

@Alexandru_BD is right; the notification coming from our product is important to let the user know it is not a problem with the product itself, and also indicating there is a maintenance operation to be done. If an update is carried out automatically and the user does not see anything, as in the described case, the update event is still recorded and available on the Notifications panel.

To make a long story short; the drivers are always on (unless Windows reboot and they are updated, but the protection driver is still on); the backend product (services) update can temporarily restart for reload/reconfiguring, this meaning the drivers will continue momentarily without interacting with these functionality services (meaning they will continue to work using the last known configuration - but even if this changes after restarting services, these will inform the drivers about the changes and continue accordingly), and the application (front end and user processes) update will cut off momentarily the interaction with the user, but the backend and drivers are still running.

Of course, the whole story is even more complex than that - what I wrote mainly covers the product restart - but there are signatures and sensors, for example; such components have their own update process and we are interacting only to control the update flow (automatic or ask user), starting the appropriate update commands, reload the updated versions etc. - probably one does not need to hear everything dissected to this detail level.

And a quick disclaimer: while I have a pretty good idea about how Windows works and the product update process, I don't know in great detail each and every component involved (I was involved in the update itself only every now and then, not as an active update developer of update or protection and reading each and every line of code involved).

I hope this explains a little more about this topic.

bdagent takes care of the following (directly or in conjunction with other components) - just to name a few:

• tray icon and its contexual menu (about, update, main interface launcher)
• notifications and alerts
• some of the user processes functionality
• watchers (various processes, including bdagent) for other processes
• user events
• product components: device status, recommendations, full screen detection, contextual scan commands, USB immunizer, WSC notifications, product alerts etc.
• cooperation with other components in regard of user context (sending/receving messages from service components, status display for certain product features etc.)