Anti-Virus Software

[cmillens]

Is there a good one out there?

I think I have tried them all about now and quite frankly I am unimpressed with any of them. No doubt you pretty nearly have to have at least one. Some detect more problems than others and some are less intrusive to the system they are installed upon. Not one detects them all which is ok that is why there are updates.

My issue with them all though is when the solution to the virus, malware, adware, spyware is so intrusive as make the system they're installed upon almost worthless, I would rather live with the threat than a solution.

For eaxmple:

Kaspersky's av product is chowing down over 35% of CPU on a permanent and constant basis.

Panda was chowing down over 80% :eek: of my CPU constantly and made logins following a boot a 20 minutes exercise in patience.

Sophos was not even worth the used up bytes on the drive and made using windows explorer a real issue with a nearly 5 minute wait on EACH mouse click!

BitDefender was an out and out joke and made traversing the internet painful at best with 10+ minutes waits for even my INTRANET sites.

Norton? Would not even find the BASIC issues.

I would go on with more but I am quite frankly sick of the "solution" to the problem.

I have tried ALL of those and many, many more on even a freshly installed system. Why can't these product be less instrusive to my system?

I am a software developer with over 30 years experience and just can't understand why these products have to suck ALL my resources ALL the time "protect" me.

Your thoughts?

[lynchknot]

First of all cmillens, Welcome to Techzonez!

Have you tried the new NOD32 beta
Here's download: http://www.nod32.com/download/downbeta.htm

Resident CPU use:http://img116.exs.cx/img116/4474/nod5nc.png (http://www.imageshack.us)

Running on demand scan (CPU varies but never 99%):

http://img87.exs.cx/img87/5511/nod23zv.jpg (http://www.imageshack.us)

On demand config for this scan (yes, I'm taking screenshots and posting this with 54 processes running while scanning and don't even notice any drag(amd xp2000 w/1gb pc2700 ram)

http://img85.exs.cx/img85/9669/nod1vx.jpg (http://www.imageshack.us)
Among more features here's the basics:

New features:

Kernel

* Adware/Spyware/Riskware detection
* Potentially dangerous applications detection
* Generic detection of the most common threat families
* Improved scanning of self-extracting (SFX) archives
* Early Warning System1
* System startup file check
* License manager
* Windows XP Style dialog windows

On-demand scanner (NOD32)

* NTFS Alternate Data Streams (ADS) check
* Improved profile customization
* New command line parameters
* Information on file from which the memory infiltration originated
* Improved file specification by mask

[cmillens]

Thank you - glad to be here. I am hopeful that I can contribute at least a little to community here. I have derived so much from it already - seems fair that I return the good deeds.

Actually, believe it or not, NOD is not one I have tried. Off to snag the beta and begin testing!

I will post back results within a day or so ... THANK YOU!

[Curio]

Do you really think anyone would use these products if they made you have a 20 minute logon, 5 minutes per click, 10 minutes per webpage? Of course they wouldn't. Whatever your problem is I don't recognise those symptoms and I have used all those products.

What is your PC spec?

[lynchknot]

You see my PC spec. I gave up on KAV and Avast. Boot times were extended beyond patience and resident protection would not allow me to use computer normally.

[Curio]

KAV is murder I can agree with that.

[lynchknot]

You've got a PM curio that may interest you.

[cmillens]

Hey there Curio.

Presently I am using an ASUS A7n8X-Deluxe mobo with a 2800+ CPU and 2 GB's of DDR400 RAM. I'm using the SATA Controller on the board for my 2 300 GB HDDs with an ATI Radeon 9700 Pro vid card (Omega Drivers rock!). I use the NVidia built-in NIC since the 3Com drivers have serious issues but am considering acquiring a Gb NIC since I prewired the house with CAT 6 when we built it. This is my personal play box. At work I use a dualie XEON 3.2 GHz Intel board ... bloody dogs there won't lemme get a REAL machine!

My work box at home is an ASUS P5AD2-E Premium with an LGA775 P4 CPU at 3.6 GHz and 2GB's DDR2-533 RAM with 2 300 GB SATA Drives and an NVIDIA nForce Professional 2200 PCIX video card.

Wife gets the Athlon 1.7 and the 1.6 and the daughter gets the Althon 2600+ since she's more a power user than the wife. Son is 3 so he get the ancient Duron I had in the dark ages ...

Since I am behind an F5 BigIP 540 Router and a Sidewinder G2 Security Appliance I never bothered with the av crap on the actual boxes but lately with the advent of more sophisticated intrusion methods and the Wife's and Daughter's continued insistance on downloading EVERYTHING they find on the net and running it without even considering that it could present a problem not only to the data they have on their machines but the servers and not to mention my personal livelyhood as a senior software architect. I am constantly working on 4 or more products at once.

Yes, perhaps I exaggerated a tad on the boot delay but when you're used to logging in in meres seconds (my windows workstation used to boot in under 3 seconds and NOW? - don't even ask! I hit shutdown/restart and go get some coffee and play with my son before I can USE the box again and THIS install is only 2 weeks out!), waiting even a few seconds is a significant bother. I am used to blasting around my network here and even an added 1 second delay feels like an eternity. Context menu delays are ridiculous (yes, I tweak everything with windows for even the millisecond.) And, I have little to NO respect for the latest trend in software - BLOATWARE. I mean really! Does it hoenstly take 20+ megs to run some stooopid anti-virus program? Kav is currently eating up at least that much! MS? Office blows into 1.2 GB's after install and that's NOT with the 100+ megs in updates you HAVE to have to just to keep safe from the bozo's out there trying prove they're more of a man than some dingle-berry at the grade school down the street!

---- BEGIN RANT

I am an old time coder used to grabbing the CPU registers by the butt and SQUEEZING every last speed glitch I can from them. For example: the decrement instruction on Intel CPU's have a slightly lower time cost than does increment but with nearly ALL the software I see anymore it's for( i = 0; i < n; i++ ) instead of the other way around and it pisses me off no end. And don't even ASK about the optimizations the compilers take - some are good, most are junk and almost NONE will reverse that to attempt optimization. In fact, anymore on the C++ code I do I'll take the compiled code and decompile it optimize it by HAND then run it through an assemby compiler just cause I come from where waiting 5 minutes for transaction to complete can cost BIG MONEY with 2000 reps banging on it. If 2000 reps wait 1 second each 10 minute interval well that's 200 wasted minutes each hour or nearly 1600 minutes each 8 hour work day for a ripping 577 wasted hours each month. You see, I come from a driver background having developed the original G2 printer drivers and the Cirrus Logic video drivers (anyone remember them? :p ) back in the 80's and don't even GET me started on the NIC drivers - most are absolute JUNK ( Flaw Found in Ethernet Device Drivers @ EWeek (http://www.eweek.com/article2/0,1759,1657910,00.asp) and Testing Vendors Target NIC Performance Problems @ EWeek (http://www.eweek.com/article2/0,1759,1777452,00.asp)

--- END RANT

[PIPER]

Hey there Curio.



---- BEGIN RANT

I am an old time coder used to grabbing the CPU registers by the butt and SQUEEZING every last speed glitch I can from them. For example: the decrement instruction on Intel CPU's have a slightly lower time cost than does increment but with nearly ALL the software I see anymore it's for( i = 0; i < n; i++ ) instead of the other way around and it pisses me off no end. And don't even ASK about the optimizations the compilers take - some are good, most are junk and almost NONE will reverse that to attempt optimization. In fact, anymore on the C++ code I do I'll take the compiled code and decompile it optimize it by HAND then run it through an assemby compiler just cause I come from where waiting 5 minutes for transaction to complete can cost BIG MONEY with 2000 reps banging on it. If 2000 reps wait 1 second each 10 minute interval well that's 200 wasted minutes each hour or nearly 1600 minutes each 8 hour work day for a ripping 577 wasted hours each month. You see, I come from a driver background having developed the original G2 printer drivers and the Cirrus Logic video drivers (anyone remember them? :p ) back in the 80's and don't even GET me started on the NIC drivers - most are absolute JUNK ( Flaw Found in Ethernet Device Drivers @ EWeek (http://www.eweek.com/article2/0,1759,1657910,00.asp) and Testing Vendors Target NIC Performance Problems @ EWeek (http://www.eweek.com/article2/0,1759,1777452,00.asp)

--- END RANT

welcome cmillens.....rant on my friend, I enjoyed every word of it...especially the part about the NIC drivers.....previous member of the "Dell" family....God I hated issues that involved those drivers...used to drive me :eek:

[Curio]

I love a good rant. I believe a lot of the bloat in a lot of software is copy protection. A person as experienced as you probably doesn't need antivirus, you are antivirus. Something like ProcessGuard to flag up or stop new apps running would likely do enough for you.

Security and ease of use are opposites so you will always have a trade off and only you can decide what is acceptable to you. If you want something that does all that scanning but has no or little cost well it does not exist. Everything you run as you so rightly say has a cost to the system and even if it is small then over a large number of repetitions it can become significant.

Rant on - it's theraputic.

[lynchknot]

As fastgame would probably say: one word - Raptor.

[cmillens]

well the verdict is in on NOD and it's now removed from everything. What a nightmare. VS.NET couldn't get the web sites opened, browsers could not reach localhost - 3 times in 15 minutes the system just went completely south ... Sigh!

My search continues ...

[PIPER]

well the verdict is in on NOD and it's now removed from everything. What a nightmare. VS.NET couldn't get the web sites opened, browsers could not reach localhost - 3 times in 15 minutes the system just went completely south ... Sigh!

My search continues ...

I have to agree with u on NOD....same problems when I tried the demo....drove me nuts for a couple of hours B4 I dumped it....what a pain in the butt :mad:

[lynchknot]

Heh, I'm still running NOD32. I had a problem with a corrupt file that seems similar to your problem (could not get online) but fixed it. Here's my thread and fix: http://www.wilderssecurity.com/showthread.php?t=75249 Installing in safe mode fixed everything

Runs great for me now. As far as for my PC, it's the best AV out there. Many have similar experiences here: http://wilderssecurity.com/showthread.php?t=73278 Perhaps it's conflicting with some app/driver or maybe a bad install.


*edit - I've got 11 Firefox tabs open, 53 processes running and I'm running an "on demand - deep scan" right now as I post this. I have no problems navigating to any site and do not notice any drag whatsoever. :p

[tarun]

Can I use anything other than AVG along with Mcafee (and Kerio free/ZA Free) ?

[efc]

Can I use anything other than AVG along with Mcafee (and Kerio free/ZA Free) ?

I would recommend getting behind a router and removing Zone Alarm. Sure simplifies software conflict issues.

[cmillens]

Since I've seen and heard so many good things about NOD I decided to give each one a shot again. These are the ones I tried: Panda, Kaspersky, NOD32, NAV, McAfee, Sophos, AVG, BitDefender, Avast!, eTrust, Command, eSafe, InVrcible, Solo, Protector Plus, QuickHeal, Norman, Bootminder, AnalogX, VCatch and GFI.

Since I do all my development in VPC and the HDD's I use for VPC reside on the server, I decided to give each a REAL shot as follows:

1) Format and install Windows XP SP2 with ALL MS Updates.
2) Install Office 2003 and apply all office updates.
3) Gather timings and other system performace data via PerfMon and save off to the server.
4) Install the AV product under examination and regather the same system timings via PerfMon and compare them all.

Yes - I performed each step above for each of the products listed above!

I am pleased, ver pleased in fact with NOD32. Fastest sucker there was of those I tried and the least intrusive. Not the BEST Virus database but there are updates daily. Currently using the following:

Trial version
Days left: 30

NOD32 Antivirus System information
Virus signature database version: 1.1074 (20050421)
Dated: Thursday, April 21, 2005
Virus signature database build: 5525

Information on other scanner support parts
Advanced heuristics module version: 1.013 (20050303)
Advanced heuristics module build: 1078
Internet filter version: 1.002 (20040708)
Internet filter build: 1013
Archive support module version: 1.028 (20050411)
Archive support module build version: 1114

Information on installed components
NOD32 For Windows NT/2000/XP/2003 - Base
Version: 2.12.4
NOD32 For Windows NT/2000/XP/2003 - Internet support
Version: 2.12.4
NOD32 for Windows NT/2000/XP/2003 - Standard component
Version: 2.12.4

Operating system information
Platform: Windows XP
Version: 5.1.2600 Service Pack 2
Version of common control components: 5.82.2900
RAM: 3192 MB
Processor: AMD Athlon(tm) XP 3000+ (2279 MHz)

I will be purchasing this sucker soon as I post this!

Thank you all for your help and suggestions - I am indebted!

[Curio]

You didn't test them on actually catching viruses then?

[lynchknot]

I thought you did not like NOD32 - in post 12.

[Conan]

NOD may be good at detecting viruses but it's weak at removing them.

[lynchknot]

Well Conan, you know what they say, "An ounce of prevention is worth a pound of cure"

Here's some more info; when you coose the option to scan with NOD32 from the context sensitve menu, it just scans for viruses. in the nod32 log it will show the virus highlighted in red, so then if you were to right-click on that it would offer you the option to clean, or if you instead click Clean rather than Scan, it will scan for viruses and give you the prompts you have set.

If you start the scanner with the right-click context menu it will automatically start up in Scan mode, not Clean mode, and will just highlight infections in red.

if you start the scanner using a scheduled job it again only scans and doesnt actually take any action during the scan. its up to you to go through the scan log and right click the infections and take action.

[QUOTE]Maybe i'm missing an option that i havent set correctly, but as far as i can see if you want to start nod32 in Clean mode (so it either cleans, deletes, however you have it set), you have to either start it from the Control Centre and hit the Clean button, or start it via the Right-click menu and click Stop to stop the Scan mode and then click Clean to begin the Clean mode.



http://img255.echo.cx/img255/1391/rightclick5yi.gif (http://www.imageshack.us)

[rik]

For what it's worth I'm running both the NOD 32 and Avast free versions and have been quite happy with their protection. Also running AVG on my Son's system and it's done fine as well.

[FastGame]

Also running AVG on my Son's system and it's done fine as well.

Thats more an attribute to your sons fine upbringing, not the effectiveness of AVG ;)

Software isn't security, security is between the ears.

[rohitk89]

Anyone seen this (http://www.schadentech.com/Reviews/Antivirus/conclusion.htm) and this (http://forums.spywareinfo.com/index.php?act=Attach&type=post&id=80) at anandtech?

I'm using Kaspersky as of now (with Sygate.) They do a fair job...

[Conan]

Anyone seen this (http://www.schadentech.com/Reviews/Antivirus/conclusion.htm) and this (http://forums.spywareinfo.com/index.php?act=Attach&type=post&id=80) at anandtech?

I'm using Kaspersky as of now (with Sygate.) They do a fair job...

While Kaspersky is one of the best it's also the most resource hungry. I don't agree with that review.

[Curio]

You should be aware that 90% of all viruses only exist in a lab, it's capture of wild list viruses that is important and the ability to de-code evasion techniques like use of exe-packers or unusual archive formats. What people want additionally is not that a product catches 'viruses' per se but that also it catches any other malware such as trojans, malicious adware/spyware and worms.

My previous comment was just what an unusual method of testing it was for an antivirus product - being as it did not involve testing what the product is actually for. Nod is very good generally but as conan says it has been poor in the removal side. Once you are infected I think you will find removal is very important.

For pure detection I don't think you can beat GDATA AntiVirusKit which combines both the Kaspersky and Bitdefender engines but is a performance killer. Personal preference dictates what features mean the most to you.

[neoLeech]

I don’t get why people say kaspersky takes a lot of resources.
My machine is only p4 1.6ghz 512mb ddr2100 and I don’t notice that much of delay compared to when it wasn’t installed. The on demand scan does take a lot of cpu power and awhile but I set it at the maximum for the on demand. Kaspersky is the only anti-virus that I have ever felt protects me from viruses. All the other ones either slowed down my comp or didn’t feel like they were protecting me. I’ve tried Panda, norton, mcafee, kaspersky, nod32, and BitDefender. Panda had a nice interface but on startup it changed to spanish?? until you closed and restarted it. norton ,mcafee, and bitdefender slow my comp down too much. Nod 32 looked promising but the interface didn’t seem there. It would say there was a virus and not seem to do anything about it. Kaspersky on several occasions found a virus and deleted it without asking questions. Once it deleted an infected important system file. Has anyone ever tried this one product that’s kind of like a firewall for programs running in the background? It will give certain ones permission and stop the others from running. It’s called Safe'n'Sec ironically made by starforce. It looks like nothing I’ve seen before, I was wondering what people who have used it think.

[FastGame]

If you like Kaspersky and it runs fine on your system then I see no reason to change, KAV is top notch and the benchmark for other AV's ;)
Has anyone ever tried this one product that’s kind of like a firewall for programs running in the background? It will give certain ones permission and stop the others from running. It’s called Safe'n'Sec ironically made by starforce. It looks like nothing I’ve seen before, I was wondering what people who have used it think.

Safe'n'Sec is excellent, but it uses the Bitdefender engine (you stated "don't like") for AV. You could add Prevex Home (free) (http://www.prevx.com/prevxhome.asp) to your KAV and end up better than Safe'n'Sec.

[webdivauk]

I'm giving http://www.bullguard.com internet security a whirl atm (they give a 60 day trial). I was previously using Norton internet suite but my system was increditly slow to start up, as my router has a Firewall anyway I trimmed down to just the Anti-virus but it's still slow. I must say the bullguard anti-virus runs without any noticable strain on my PC and it's currently checking all drives with ease. I don't activate the firewall as I can't see any gain in having two running, should I run a software firewall rather than just relying on my router?

I haven't dabbled with any ad blockers etc as I'm using Firefox and I don't get many. It annoys me greatly having to have a zillion programs running just so that I can surf around in peace. Do I really need an adware checker?

[FastGame]

Bullguard uses BitDefender engine and definitions, as of late Bitdefender has put a move on and is up with the tops in AV.

My ISP uses Bullguard, I've never had a virus through the mail.

Do I really need an adware checker?

Might be wise to use this http://www.techzonez.com/forums/showthread.php?t=15799

[beelzebub]

I like complaining as much as the next guy, but this is a case of you want to have your cake and eat it too. You want to have security but you dont want your computer to run any slower, it can be done if you dont notice a few millisecond difference on start-up or when pages load, but if you are using programs to time out how many extra clock cycles it requires to run an av or anyother program in the background, then your never going to be happy.

Also imagine if you weren't able to find an av that doesnt slow down your computer, you would have to live with it cause imagine the alternative a virus that would prevent you from starting up alltogether.

I say take what you can get and stop complaning. Or, make your own AV.

Sorry if this sounds kind of harsh i have had a lot of pent up anger recently, it needs to come out someway.

[lynchknot]

Sorry if this sounds kind of harsh i have had a lot of pent up anger recently, it needs to come out someway.


Better here than in real life with your kids and/or loved ones. I completely understand. I, sometimes, do the same - many of us do.

[ch0pper]

kav is the best out there for anthackers mailware

[Curio]

kav is the best out there for anthackers mailware
I often hack ants through the mail.
:)