Battle Bitdefender Total Security or Microsoft Defender — Who Wins for Everyday PC Users?

[Parkinsond]

I prefer H_C, plus CD and FH. I'm unsure whether terms like "hardening" or "advanced security" for Windows make users think the software is too complex. @Andy Ful's Tools are user-friendly, in my opinion. The tools' security and usability design make them better and easier to use than similar software like OSArmor, Application Control Manager, or smart-deny software such as CyberLock or Comodo. The notable "Run By SmartScreen" function stands out, boosting both security and ease of use. Everything has been smooth; running, updating, and installing software has been issue-free on my family's and kids' systems. In my view, default settings, the whitelist, and whitelisting your portable apps folder should be enough for most people's security and usability needs, offering a comfort level similar to traditional security.

I like WHHL more; simplicity lures to use security; some prefer B for not having too many options in settings.

 

[Trident]

I like WHHL more; simplicity lures to use security; some prefer B for not having too many options in settings.

They removed a lot of settings, there used to be Real-Time Protection slider with 4-5 levels, Active Virus (later Threat) Control slider with 3 levels and IDS (an AVC spin-off) slider under firewall with 5 levels. They removed all that but BD is still one of the more settings-rich AVs. They had HIPS at one point (very basic, just 4-5 type of alerts including AutoStart creation) and they had Data Loss Prevention. All gone. TuneUps are gone. Backup is gone. They started as Norton 360 and ended up as ZoneAlarm Next-Gen

 

[Parkinsond]

They removed a lot of settings, there used to be Real-Time Protection slider with 4-5 levels, Active Virus (later Threat) Control slider with 3 levels and IDS (an AVC spin-off) slider under firewall with 5 levels. They removed all that but BD is still one of the more settings-rich AVs. They had HIPS at one point (very basic, just 4-5 type of alerts including AutoStart creation) and they had Data Loss Prevention. All gone. TuneUps are gone. Backup is gone. They started as Norton 360 and ended up as ZoneAlarm Next-Gen

View attachment 290011
View attachment 290012

Did not use the paid version; I use only free software; free B has few settings.

 

[oldschool]

I forgot about Microsoft Defender SmartScreen in Security Center >> App & browser control >> Reputation-based protection

And let's not forget the winner of 2 Academy Awards (or at least 1) - Smart App Control.

 

[Zero Knowledge]

WD. Less problems & add Andy Ful's tools and your sweet.

I'll never use BD again after it removed WF when uninstalling the free version after fresh OS install. Honestly what garbage, really what kind of software does that?

 

[rashmi]

I like WHHL more;

The SOLITUDE guy likes WHHL... Whisky Helps Hide Loneliness!

 

[piquiteco]

Or maybe the attacker will be merciful and will clean the machine.

 

[RansomwareRemediation]

They removed a lot of settings, there used to be Real-Time Protection slider with 4-5 levels, Active Virus (later Threat) Control slider with 3 levels and IDS (an AVC spin-off) slider under firewall with 5 levels. They removed all that but BD is still one of the more settings-rich AVs. They had HIPS at one point (very basic, just 4-5 type of alerts including AutoStart creation) and they had Data Loss Prevention. All gone. TuneUps are gone. Backup is gone. They started as Norton 360 and ended up as ZoneAlarm Next-Gen

View attachment 290011
View attachment 290012

They eliminated whatever it was, it doesn't matter, Bitdefender is still the best and most powerful antivirus that exists. It bothers whoever it bothers.

 

[Parkinsond]

The SOLITUDE guy likes WHHL... Whisky Helps Hide Loneliness!

I like it, although not using it currently; I can do all the job by GP.

 

[Andy Ful]

I like it, although not using it currently; I can do all the job by GP.

Can you conveniently block shortcuts?
In practice is impossible to apply similar protection to WHHLight via GP (GPO) - too many rules required. There is also a problem with applying WDAC whitelisting (on Windows Home).
Some GPO rules might not work as intended (especially SRP rules). However, simple GPO setups can also do the job.

 

[Parkinsond]

Can you conveniently block shortcuts

If I double click malicious shortcut, what this shortcut is going to do?
Launch malicious script, right?
As scripts are blocked outside system space using AppLocker, the malicious process will be aborted.

 

[Sunqfu]

Does Bitdefender use Sandbox, I think they have it in their endpoint solution, but I couldn't find anything about it in their home version.

 

[Andy Ful]

If I double click malicious shortcut, what this shortcut is going to do?
Launch malicious script, right?

It can run anything, including shellcode.

As scripts are blocked outside system space using AppLocker, the malicious process will be aborted.

AppLocker cannot block shortcuts.

 

[Parkinsond]

AppLocker cannot block shortcuts

but it can block scripts which shortcuts launch to complete the malicious process.
Of course WHHL has the advantage of blocking the malicious cascade at an earlier stage, but eventually it will blocked either by WHHL or AppLocker script rules.

 

[Andy Ful]

but it can block scripts which shortcuts launch to complete the malicious process.
Of course WHHL has the advantage of blocking the malicious cascade at an earlier stage, but eventually it will blocked either by WHHL or AppLocker script rules.

Unfortunately, AppLocker can only restrict some scripts (mainly .ps1, .bat, .cmd, .vbs, and .js). Other script types (Python, Lua, Autoit, etc.), scriptlets (.chm, .hta, etc.), and many files with active content (more than 100 file types can be used) are unsupported. Those files can bypass AppLocker (although they often need shortcuts, especially Python, Lua, Autoit, etc.).
However, if you additionally block several popular LOLBins (like those suggested by Microsoft in WDAC), probably about 90% attacks can be covered in some way.

 

[Parkinsond]

Unfortunately, AppLocker can only restrict some scripts (mainly .ps1, .bat, .cmd, .vbs, and .js). Other script types (Python, Lua, Autoit, etc.), scriptlets (.chm, .hta, etc.), and many files with active content (more than 100 file types can be used) are unsupported. Those files can bypass AppLocker (although they often need shortcuts, especially Python, Lua, Autoit, etc.).
However, if you additionally block several popular LOLBins (like those suggested by Microsoft in WDAC), probably about 90% attacks can be covered in some way.

I use SAC and I can manually create SRP and modify the file types restricted, but it is not an easy task especially for below than average use, where WHHL comes to make this enforcement an easy job.
I enjoy fiddling with GPs.

 

[IceMan7]

500 mb of definitions copied twice (and again and again on every update) certainly don’t please me, it triggers my OCD.

And they put the whole database in a package on Mac OS too.

Microsoft Defender has higher chances with me, if I remember right the intelligence was around 250 MB? And updates once a day. In the meantime the cloud does the heavy lifting.

Someone already wrote on the forum:
1. BD will deplete the signature database.
2. BD isn't the only one that has to download a lot of data – apparently Eset does too (someone wrote about this).
3. You don't need to set updates every hour, especially since BD relies primarily on ATC, not signatures. I have mine set to every 6 hours. For example, a friend of mine, whose computer never shuts down, has it set to every 12 hours. I know someone who has it set to every 24 hours, and in practice, it updates only once – right after the system boots.

 

[Trident]

1. BD will deplete the signature database.

The depletion is done once a year on a staged basis and usually Bitdefender very quickly fills up the database as well.

Yes, Eset was also reported to have massive writings in terms of data on reboot, the issue was reported by @SeriousHoax as well.

3. You don't need to set updates every hour, especially since BD relies primarily on ATC

The ATC behavioural profiles are updates as part of the virus signatures.

 

[IceMan7]

The ATC behavioural profiles are updates as part of the virus signatures.

I know they're updated. However, BD isn't primarily based on signatures, but on behavior. So you don't have to update every hour like ESET does.

Yes, Eset was also reported to have massive writings in terms of data on reboot, the issue was reported by @SeriousHoax as well.

Yes. Exactly. @SeriousHoax

 

[Trident]

I know they're updated. However, BD isn't primarily based on signatures, but on behavior. So you don't have to update every hour like ESET does.

According to Bitdefender OEM documentation and telemetry, vast majority of detections are based on their pre-execution engine.

Bitdefender is NOT primarily based on behaviour, every single layer contributes. The AVs that are primarily based on behaviour are Webroot and Trend Micro.