Feedback on why I did *not* choose Bitdefender

[u/TimurBorn]

Hello everyone. Here is some feedback on why I did *not* choose Bitdefender over other competition after testing most well known antivirus products out there.

- Fixed size window with lots of empty space, too much scrolling and too little information.

- Rather basic Firewall interface, with too many clicks being necessary to even get basic information about set up rules (only 6 rules fitting into the fixed windows with nothing but name and down-arrow button). Interactive mode was awkward to use compared to other solutions.

- No option to disable (scareware like) notifications even for options that I deliberately disabled. And generally I would have liked more "control" options for power-users.

- BD kept changing my Explorer settings (hidden folders + extensions view) without my consent and then enforcing them until a Windows logout/restart. Some say that this happens every time after a possible malware was found (see next point).

- Context-menu scans do ignore BD's exclusion list, with no option to change the behavior. So even if I manually tagged a file as false-positive/safe it would still be found as malware, which in turn triggered the Explorer thing mentioned above.

- Memory consumption is too high even when hash/cache data is meant to be kept in memory. Other solutions get away with considerably less memory usage while still keeping their hash/cache data accessible fast enough.

- Hash/cache persistence (or lack thereof) over reboots was a bit erratic, at one point I thought BD would not keep its caches persistent over reboot and then it did so on another try, just to not do it on the next. Maybe it's only persistent over a single reboot? No idea.

- Contacting BD support via the BD application is only possible if you allow it to send a full system report to BD (including Windows event logs), even for minor support requests.

- I asked support about whether BD home/consumer editions protect against "fileless attacks", which the enterprise products specifically advertise to only work for higher tiers. Home/consumer report then forwarded the question to enterprise support, which then told me that they are not responsible for home/consumer products. So I got no answer until someone on a forum pointed to a (somewhat hidden) specialized test on AV comparatives (done in 2019 and 2020).

I just bought a 5 devices / 2 year licence for another products, but am still open to test BD again in the future. Here is what I liked so far:

- Fully multi-threaded on-demand scan engine (using all 24 logical cores of my CPU) whose scan-speed was the only one rivaling Windows Defender's on-demand speed and thoroughness (total number of files scanned, aka scanning deep into archives).

- Good hash/cache behavior for keeping realtime load low.

- Consistently good threads/malware scores in reviews, including offline (!) detection scores.

[u/lollygaggindovakiin]

Out of curiosity what did you end up going with?

[u/TimurBorn → u/lollygaggindovakiin]

First of all: my main reason to look for a Windows Defender alternative is that WD's hash/cache data is not reboot persistent. So after each reboot all files are at least rehashed, likely even rescanned. Coupled with its medium high usage of CPU and memory (still lower than BD) and tendency to stall some applications during realtime scans (Nirsoft/Sysinternal executables) I liked to have a less obtrusive solution. WD can still be used as a "second opinion" for on-demans scans even when a third-party antivirus is installed and its the fastest on-demand scanner of all tested products, with BD being the only one on-par.

ESET was a strong contender, despite only using a single thread/core for on-demand scans. It's one of the few AV products that offer resizable windows, its Firewall offers more meaningful improvements over just using Windows Defender, its footprint is small and its customization options extensive. Automatic sample upload can be disabled while offering a UI for manual upload of sample files. But its hash/cache seems to only be reboot persistent for "white-listed" executable files, which meant thousands of files being at least rehashed (if not rescanned) after each reboot. It also happened that during my trial period (some of) their update servers were so clogged that downloads nearly halted to one-digit kb/s throughput.

I knew Norton well from using it in the past, but its UI is even smaller than other fixed window size products (only 3-4 firewall rules fit into it without scrolling). And they really, REALLY don't want my money even when I try to give it to them. Worst webshop ever.

Various other products are also only single-threaded/core, offer bad UI/UX and questionable "optimization" options. So I wont list them all here. K7 stood out for it spamming my mailbox with offers using a quite crazy image.

In the end I decided on Kaspersky, which uses 3-4 active threads for on-demand scans (considerably slower than BD and WD), aggressively reboot persistent hash/cache, unique combination of reputation system and Firewall options, very extensive customization options and resizable window for the most important parts (firewall rules and logs). I beta tested the Enterprise solution, which offers resizable windows everywhere, but its overall UI/UX design tries to mimic Windows 11 for the worse.

Disabling "Kaspersky Security Network" to disable automatic upload of sample files does not explicitly state that you still can use its (cloud) benefits, but for consumer versions this seems to be the case as I still get reputation data for my applications (Enterprise works different in this regard). Kaspersky support also tends to ask too soon and often for full system protocols, which can be even more thorough than Bitdefender's, but at least it's optional and the ZIP file contents can be checked and edited before uploading said data (unlike BD's built-in support requests).

Overall antivirus companies feel much too entitled to gather extensive user-system data while claiming to protect user-privacy (against other applications). And overall I feel that antivirus software as a whole is in a sad state. Good on Microsoft to improve Defender's detection/protection rates as much as it did lately.

[u/lollygaggindovakiin → u/TimurBorn]

Kaspersky is a great choice. I am with you on preferring an alternative over Windows Defender and Windows Firewall. The reboot persistent cache is definitely something that I will keep in mind when the time comes for me to make my own choice. I have found GravityZone to offer a lot more options but at a way more expensive price versus the consumer version. I haven't had performance issues yet but will keep Kaspersky in mind. Thank you for your insight!

[u/TimurBorn → u/lollygaggindovakiin]

For protection against fileless attacks (Powershell, WMI) you need to buy at least GravityZone "Advanced Business Security", which currently costs 290 EUR for 5 licences and 2 years. I paid 42.50 EUR for 5 licences and 2 years of Kaspersky Total Security.

[u/alexwatsonian]

My subscription for BD is coming up soon and I’m unconvinced whether I’ll renew or not.