Do Virus Scanners Slow Down Your System?

[Guest]

Where is Microsoft Security Essentials ?

 

[jimmysmitty]

[citation][nom]Hupiscratch[/nom]I think Microsoft Security Essentials should be included if possible and there is a situation that I think it is greatly affected by anti-virus software: Windows start-up.[/citation]

Yes. I am suprised that a vast majority of the free ones, which actually are much better than the paid for ones, were excluded. Ones like Avira or MSE. Yet they include AVG which has fallen pretty far from great in recent years.

I prefer MSE even over Avira because it gets a few really bad ones that Avira still wont find such as Aluereon.

 

[shurcooL]

What you _MUST_ test next is the effect on performance during an automatic update for the anti-virus.

This is when I notice how much they can slow down a slower computer (e.g. a netbook) to a crawl.

This is especially annoying when you turn on a computer for the first time after some time passed (a few days/weeks), which happens to me often since I have like 4 computers in total, and it starts to do the auto-update _first thing_ after Windows loads. ARGH~!

 

[cleeve]

I'm also disappointed that you didn't check the Free product "Windows Security Essentials" -- perhaps you are are dissuaded from testing and comparing 'free' alternatives to those solutions that pay your bills, though I would think some of your advertising revenue comes from MS. I have NO idea if MS's solution would come in faster or slower, so I'm not suggesting that it was left out because it is better -- just that it is free.

As a writer I don't really have any contact with the advertising side. I chose scanners that data indicated have a widespread user base. AVG has a free version, by the way.

I'm not sure why some people assume that a free AV scanner might perform wildly different than a paid-for AV scanner.

But it disturbs me that you thought a multicore processor might yield better results than a single core processor. It is next to impossible that it would.

Actually, I try to avoid assumptions and test even things that I might not consider possible. Assumptions are often incorrect. Often this attitude leads us to interesting discoveries.

Case in point: the single-core internet page load time was significantly longer with the AVG security suite compared to the AVG virus scanner, but only when a single-core CPU is used.

But if nothing else, such tests can support a hypothesis and dispel myths.

 

[Lewis57]

I knew Norton had improved over the years and is now my first choice for family members and such. But I'll stick to MSE as it's free, small, and I don't need an overkill anti virus as I haven't had a virus in years.

 

[jhatfie]

Test should be repeated on a system with 2GB. I of course do not have a system with less than 4GB, but my parents do, with their older systems and are always running into problems with slowness. Generally this is because they have 10000000 items that start at boot, but antivirus programs seem to sometimes be fairly RAM heavy and can negatively impact a more modest computer.

 

[jerreece]

I'm surprised you did not test Avast. I've been using their free home edition for a long while now. It does a fantastic job, and is virtually unnoticeable. It just works, and doesn't bug me.

Used to use AVG in the past too though.

I'm surprised to see that Norton doesn't seem to have the HUGE penalty on system performance I always knew it to have. Wonder if they've made some massive changes...?

 

[alexttlyrocks]

no avast? and no comparison to an intel processor running antivirus?

 

[Guest]

why such a small number of anti virus programs testes, what about mcafee and nod32, along with the dozens of others out there. what about those ppl who are running older computers, with xp and less than a gig of ram. have you even thought about what kind of performance hit there could be when the anti virus is actually scanning for viruses on the hard drive?? i repair computer for average ppl all the time that have no idea what they are doing with there computer, let along what the different in a single core and a quad core cpu. and most of the ppl that are not tech savvy don't want to leave xp. try doing the test on a cheap ($300 or less) that average people that would buy with how the computer comes set up, and see what kind of results you get

 

[wcooper007]

Its amazing that people still think that av software will run while you are doing anything that is intensive. i currently run norton 2011 on my unit and every computer in my home has it as well and it never scans anything when there is more than 50% cpu usage which if my computer is using that much than i am probably running two instances of the same game at the same time but other than that i have never seen a single slow down.
oh and i also work on somewhere between 100 and 200 computers a week and we are constantly installing norton on computers that are 5 to 7 years old and we dont notice a slowdown on them not like we do with mcafee or avg and most of them come in to have viruses malware and spyware removed from them which goes to show you that those free av software are designed for very narrow scanning.

 

[wcooper007]

[citation][nom]Astara[/nom]I'm disappointed in the applications that you tested and your knowledge of how virus and malware scanners work. I'm also disappointed that you didn't check the Free product "Windows Security Essentials" -- perhaps you are are dissuaded from testing and comparing 'free' alternatives to those solutions that pay your bills, though I would think some of your advertising revenue comes from MS. I have NO idea if MS's solution would come in faster or slower, so I'm not suggesting that it was left out because it is better -- just that it is free.But it disturbs me that you thought a multicore processor might yield better results than a single core processor. It is next to impossible that it would. Why? Nearly all of these are 'on-access scanners (besides background scanning and heuristic scanning that CAN make use of multiple processors), but the biggest slow down comes from the 'on-access' scanning that happens *synchronously* -- meaning that it happens in synchronization with the access -- the scan has to come *first*, THEN it comes back with an "ok/not ok" -- which then allows execution to proceed. Since such scanning is purely sequential, it cannot benefit from multi-threading or multiple cores.I noticed significant (by my definition of 'significant') performance hits from on-access scanners on my 6-core, 24GB processor. So much so, that I went back, to NOT using an 'on-access' malware scanner at all. I am retaining the background, periodic scanning, as well as the ability for me to 'right-click' on any suspect file, and scan it for *known* problems. But that's the crux of any of these snake-ware scanners -- they can only catch things that are known about. Sure, a few have heuristic scanners that try to detect 'weird' behavior, but those are still in the primitive phase and can easily generate as many false positives as real ones.All the above said, I've been running on the internet since before there was an internet (i.e. since ~89), and have never caught any malware. But then I don't execute random programs and don't execute 'scripts' from foreign sites (no java script, no java, no flash, etc...). No automation is the *default*. From there, I add sites to my permitted list -- some get added to the 'permanent list' -- sites I need to visit frequently and I trust. But others get temporary visa's by default.IMO, for *smart*, knowledgeable and careful users who know what is risky and what is not, virus and anti-malware stuff is 'snake-oil'. An exception to that is a good firewall, since Windows, especially has historically been configured to be 'too friendly' and 'too open'.In fact, my local setup has my windows box on an isolated subnet that goes through a linux-based proxy to get to the internet. Until recently, the linux box was behind another hardware-firewall box, but I've realized that with a correcly configured linux-box (with itself set to drop unknown incoming packets), the extra hardware box is more trouble than it's worth.Running any monolithic app, is unlikely to be affected by virus SW, but anything that does alot of file accessing, will be hurt proportionally. You'll also see a larger 'hurt' the faster your disks and network is -- since the processing time for the virus scanner is a constant amount of CPU, and with a faster disk, that CPU amount will figure more prominently, same goes for network access - the faster the network access, then the more the cpu usage will show up as delays.It really depends on peoples usage and what they do -- if they download software and execute it alot, then they probably need scanning SW. But if you only download from trusted sources, or only download video/music/pictures, you don't need it.Let me repeat that last bit -- if all you do is watch videos/ listen to music and look at pictures, you don't need virus scanning. The dangers are very minimal (if there are bugs in your existing programs, which are rare if you keep up to date). A caveat -- stay away and avoid videos that require you to download a special codec or player to play them. Just delete those videos off your system. They are not worth it. Also something to steer away from -- stay away from 'free virus scans' -- especially any that need to download something to do the scan (which is most of them). As soon as they download something to do the scanning -- that downloaded software has a high probability of ITSELF being a virus or malware.Free screen savers? Forget them, unless they come from reputable sources that you trust. Always beware of "free software" or websites bearing 'free gifts' -- they are the perfect example of modern day trojan horses. Look for open-source programs where you can look at the source and compile and run it yourself -- that's the best -- but apart from that -- look for trusted websites that offer the source or are verified by other 'trusted' services. Be careful of sites that claim to be 'certified trusted by 'XXXX'. Are they? Check with XXXX and see.... The claim to be trusted/certified may very well be bogus.Staying smart and aware is the best defense against these things -- that -- and go for the free option -- Microsoft's Home Security Essentials is VERY good. They collect aberrant behavior from all the computers that allow them to collect information -- and MS runs monthly scans on everyone's computers during updates, so they know what is out there and they know what the threats are and probably have one of the best info-bases on malware. Besides, you CAN't beat the price. I don't have their on-access feature turned on for me, but I do for my parents, and my less computer-literate friends. So consider it before you consider a 'for-pay' "protection-racket" SW package -- since malware protection is best done by those who know the OS. Ideally it should be part of the OS from day one -- and one day, maybe it will be.-Astara[/citation]


well man if everyone in the rest of the world was as smart as you than i guess there wouldnt be a need for antivirus software but thank god most people dont give a rats arse about all that crap i am sorry but i along with most average joes dont wanna go thru all that crap to get on the internet... they just want it to work... and if your computer is giving you problems when your scanning on a computer that has specs like that than you did something wrong or you dont know how to install windows maybe you should stick to linux becuase my quad core with 6 gigs of memory and dual ssd's never slows down EVER lol

 

[thomaslompton]

There is a fundamental flaw with these tests for the poor business class computer that only has 1GB or less of ram. When some of these AVs are run on those machines, they may take as much as 80 - 150MB of ram. When you only have 1GB, that can impact performance by forcing the computer to go to virtual memory prematurely, otherwise I would agree with the results.

 

[youssef 2010]

I know when my antivirus is performing background operations as my games (even the lightest ones) will go through a series of stuttering until the antivirus finishes what its doing.

 

[Guest]

But how about a real world test on thoroughness of stopping virus intrusion? I find it prety common that if I am called to remove a virus that I will find Norton installed and oblivious to the infection thaat is causing problems...

 

[drakepandor]

For a test of how well antivirus programs compare from a protection standpoint check out av-comparatives.org

 

[Guest]

Why didn't you include Microsoft Security Essentials. It's a great free product, and I'm sure a lot of readers us it.

 

[Doom3klr]

Norton and macafee do slow systems down quite a bit. But Avgs pretty good

 

[Guest]

This test did not exercise the kinds of things that are greatly slowed by anti-virus software. Opening and/or writing to many files typically has the largest impact (another comment mentioned waiting for thumbnails of a large folder of pictures). There will also be big differences depending on the file types (.exe and .dll files will be far slower than .txt files for example) since most anti-virus programs treat the types differently.

Many anti-virus products are also highly configurable. At my workplace, we use McAfee Corporate, and with its defaults Visual Studio 2008 C++ software compilation took 62% longer than without anti-virus (BTW, both AVG and MSSE only took 12% and 14% longer than no anti-virus when using their defaults), but after excluding certain kinds of scans on certain kinds of files we were able to reduce the penalty for McAfee to a little less than 20% (still bad, but the best our IT would let us do).

 

[kittle]

Like others have said - you really need to re-run these tests on a more common configuration. Not everyone has a Caviar Black in their desktops (or laptop even).

My personal experience shows that symantec AV greatly slowed down my usage of outlook. I went from frequent pausing and freeze-ups with the AV running to a well functioning system after I turned the AV off.

 

[builderbobftw]

So of these people need to understand how easy it is to program a drive-by (Link click starts an unavioidable virus download just by clicking a link). Anyone could post somethign on foumrs (Look! 6990 Benches!) and give dozens of people one of these.

 

[speedemon]

yeah, good article Toms. Stuff like this is why i started visiting this site, we need more. Give us that and ill even click on a few ads every now and then.

 

[tipoo]

Fantastic article, but I would have liked MSE to be included. Its gaining quite a good reputation in the AV world for being quick and accurate.

Also, I would love to see a followup article dealing with old or low power systems, I'm thinking Atoms, Pentium 4's, Athlon XP's and 64's.

 

[spectrewind]

I am honestly unimpressed by this article. The footprint of the scanner does have some bearing on its capabilities while running on the x86/x64 Windows platform...

A couple of good primers for this article would have cited great sites like:
http://www.wildlist.org/
http://www.virusbtn.com/index

Also, not all malware scanners are created equally...
No mention of heuristics, ring 0 virtualization, inline function hooks (your basic rootkit), sandboxing, alternate data streams (NTFS ADS)?

For example: I have seen an updated copy of Norton & McAfee ( current engine and current definitions ) be unable to detect viral code appended to a small .JPG file as an NTFS alternate data stream, basically filename.jpg:ADS_code_goes_here.
The only way to clear the problem was to copy the file to a FAT32 partion (shedding support for ADS), and then back to the NTFS drive.
Kaspersky (KIS) and NOD32 did detect the problem.

 

[pjmelect]

Microsoft Security Essentials should have been included in this review. Norton is still a poor anti virus program, it may be acceptable on a modern fast computer with lots of memory but on older computers it is a dog and can cause problems when you try and uninstall it. The artical didn't mention how much memory the anti virus programs used, some like Norton use a lot.

 

[thedexmonster]

I use Zonealarm Extreme Security Suite.