Is your free AV tool a 'resource pig?'

Topic

New Reply

TOP STORY

Is your free AV tool a ‘resource pig?’

By Fred Langa

A reader’s complaint about Microsoft Security Essentials (MSE) spurred head-to-head comparison tests of AV-software resource usage.

I put six popular, free antivirus tools through their paces and measured their impact on startup and shutdown times, disk space, and RAM use.
The full text of this column is posted at windowssecrets.com/top-story/is-your-free-av-tool-a-resource-pig/ (paid content, opens in a new window/tab).

Columnists typically cannot reply to comments here, but do incorporate the best tips into future columns.

Reply | Quote

Replies

I switched to MSE after using ZoneAlarm for years. I’ve found it unobtrusive and effective, and I’m glad to be free of ZA.

Reply | Quote

A very nicely done series of tests. I’ve been a MSE exponent for quite awhile. Only issue I’ve seen is when people don’t uninstall other antivirus and have 2 on the same PC.
That’s like having 2 women in the same house – constant bickering!

Reply | Quote

A very nicely done series of tests. I’ve been a MSE exponent for quite awhile. Only issue I’ve seen is when people don’t uninstall other antivirus and have 2 on the same PC.
That’s like having 2 women in the same house – constant bickering!

Some security programs do play well together. And a proper combination of them will provide a lot more security than a single AV program most of which miss many problems and then require batch programs to kill rootkits and other non pure virus attacks.

Reply | Quote

Quick critique:

“And on most systems, it has little effect on system resources.”

Incorrect, most systems are still running XP – not W7 SP1. As such, many will be running with much lower hardware capabilities and speed. MSE runs a restricted set of functions on XP and this OS is where many of the complaints have arisen.

The article does not touch upon a number of other scenarios where MSE has been criticized in the past:
Mobile users – many mobile users do NOT want their OS to become unusable for the first 10-15 minutes when they attempt to connect to base, check emails on the move from Starbucks or McDonalds because MSE is hogging the bandwidth with massive updates.
‘Part-time’ users/2nd computers: some machines that are only used for a few hours several times each week often do NOT receive regular updates.

Testing on a fresh, perfectly clean OS in a VM is NOT a real world, real computer scenario by any stretch of the imagination.

No mention of checking update file sizes over any time span; this can be make or break for some users, 80MB per day vs 16MB makes a big difference to those on slower connections and/or those with a restricted free download quota.

Reply | Quote

From the homepage of ClamWin:

Please note that

ClamWin Free Antivirus does not

include an on-access real-time scanner. You need to

manually

scan a file in order to detect a virus or spyware.

So there is no background application running for this AntiVirus — and hence it could have no impact on the startup time, shutdown time or the RAM usage?

Reply | Quote

So there is no background application running for this AntiVirus — and hence it could have no impact on the startup time, shutdown time or the RAM usage?

Well, it shouldn’t have a negative impact; but as it had the fastest startup and shutdown times, the only apparent anomaly in the table of figures is why ClamWin would use more RAM than Avast.

And, hey, Fred did say “ClamWin is unique” 😉

Bruce

Reply | Quote

I have been using MSE for some time now and it doesn’t impact on my p.c. in any noticable way. I have it running on 3 machines and we don’t have any problems.In fact I am having trouble getting CA’s latest version virus checker to run properly on my latest WIN7 PC and I have dropped it, after using CA for years. In fact after contacting CA’s help desk re this problem I was asked to allow one of their technicians to take over my p.c. remotely so that they could “make changes to my setup and fix the problem ….”. Needless to say that won’t ever happen. :o:

Reply | Quote

Well, it shouldn’t have a negative impact; but as it had the fastest startup and shutdown times, the only apparent anomaly in the table of figures is why ClamWin would use more RAM than Avast.

And, hey, Fred did say “ClamWin is unique” 😉

Bruce

Bruce, the “negative” numbers in the tables were said to be in comparison with the MSE Baseline, which was arbitrarily assigned a value of zero on some measures. MSE does not use 1MB of RAM, for example.

-- rc primak

Reply | Quote

Thank you Fred – You did just what I need by conducting clearly explained tests that I just don’t have the time or expertise to do and then giving results that I can understand so that I can decide for myself what’s best for me to do.:rolleyes:

Reply | Quote

Thanks, Good write up on the free AV products. I too found ClamAV to be very light on resources and fast on machine startup, but that is the deal with AmazonWS that it keeps calling out to? I was seeing tons of traffic on my firewall for AmazonServices and all originating from an .exe on the ClamAV folder, did not like that one bit, so I removed.

Reply | Quote

Fred, why does MSE only use 1MB of RAM, or was that an error …

Reply | Quote

Fred, why does MSE only use 1MB of RAM, or was that an error …

As I explained to BruceR, Fred stated that these numbers used MSE’s RAM usage as a baseline, arbitrarily assigned the value of zero. How that became 1MB, I do not know.

-- rc primak

Reply | Quote

Even systems that are still running Windows XP, MSE will be far better in terms of system resources usage, then many many other AV software solutions out there.

Reply | Quote

Surely that depends on the resources you look at, this report doesn’t cover them all, also, many of the competitors in the free for XP category might offer greater coverage, better configuration, more and easier to access feedback (for those that require it – see configuration), more frequent and smaller updates, …

Reply | Quote

Over the past years, I’ve used several of the free antivirus programs. I found MSE to be by far the the best. It is very fast on boot up, scan, and shutdown as supported by Fred’s test. The updates are very timely. I switched to it because of Fred’s recommendation. I started using it when it was first introduced by Microsoft. Here’s a comment from a friend who uses it too: “Having been through Norton, AVG, and several others, I find MS Security Essentials the least problematic and best to date.” This has been my experience with the same products.

I’m not sure where the person who wrote the letter about MSE got his opinion, but I assume he’s never used the other products.

Reply | Quote

Surely that depends on the resources you look at, this report doesn’t cover them all, also, many of the competitors in the free for XP category might offer greater coverage, better configuration, more and easier to access feedback (for those that require it – see configuration), more frequent and smaller updates, …

All of which are valid considerations. But this article was about effects (or perceived effects) on system performance.

-- rc primak

Reply | Quote

I have WIN7 Pro running on three machines, all with NAV. They are all fast machines with plenty of memory, so the footprint is not really a factor. Recently, I added the virtual XP engine to run some truly ancient but still useful specialty programs. For those, I installed MSE. One more thing to keep updated. 😉

My NAV subscription will be expiring in a few weeks, and I have been considering switching to MSE as my primary program. However, when you look at “objective” comparisons, MSE is seldom anywhere near the top in comparison with either free or $ versions. Of course those ratings often look like they were produced by random number generators, with a top program in one being near the bottom in another. Still, I find the “hog factor” near the bottom of my criteria.

Reply | Quote

Fred, you did a great job at tackling this problem. As a retired computer journalist, with 20 years experience of writing AV software reviews, I found it very thought provoking. I agree, Avira 2012 does seem rather bloated compared to previous versions.

Yet, as the comments show, there are many possible comparisons that could have affected the results. You had to choose just one. But could that have skewed the results? Complete testing would involve a bewildering number of variables – single or dual processor, amount of RAM, number of other applications installed etc. Maybe, instead of a “clean” Windows, you need some typical “real-world” software installed?

First, could the use of Virtual PC have affected the results? After all one of the biggest threats at the moment are boot sector rootkits, which are themselves a kind of virtual PC – as they load code and then make Windows think it is running on a bare system. Could Virtual PC then make Avira suspicious of a rootkit and hence provoke more extensive tests?

Second, as another comment suggested, seeing the desktop and getting to a usable system may be very different – lots of resident apps are still loading and AV software is downloading updates. One design decision for an AV writer to consider is whether to do tests before login or wait until after the user logs in. Pretty hard to test but maybe, if you started Windows with some kind of resource monitor running, you could measure time until CPU use dropped to zero?

Another design decision would be whether to do checks at start-up in order to minimize the delay caused by scanning applications on launch. Perhaps your reader’s problem was caused by slow scans on launching applications (including the many applications that think it necessary to launch themselves at start-up).

Third, I suspect that your initial reader may have had remnants of some other AV software running. McAfee and Norton, commonly found on new PCs, both have notoriously buggy uninstallers – in fact both companies have a separate cleanup/uninstall completely utility which can be downloaded from their websites. Similarly, in testing non-Microsoft AV software, did you completely disable Windows Defender, which is known to interfere with Avira?

Finally, by not looking at detection rates, have you missed the possible trade off between better detection and a slight slow down in performance. Perhaps a few extra seconds at boot time are worth it? I am asked to remove malware from 40 or 50 systems a week and while most had outdated antivirus software, I have noticed that many of the infected systems were fully updated and running MSE (or one of certain well known commercial AV programs).

So maybe MSE is very well written code that quietly does its job, or does it trade-off fast start-up time for slower application launch, or perhaps it gains speed and low resource usage by skipping many checks that would have detected an infection? Which is it?

Paul

Reply | Quote

Since when is ClamWin “a relatively new product”? Their website says “ClamWin Free Antivirus 0.87.1 released Wednesday, 16 November 2005” as their earliest entry, and most certainly it didn’t start at version 0.87.1!

Did Fred not glance at Wikipedia, where he would have found that ClamWin is the graphical/Windows interface for ClamAV, which has been running on Linux and many other operating systems for years and years – with rather poor virus detection results?

It’s one thing recommending an AV product because it uses marginally fewer resources than another one – but surely the primary function of an AV product is to trap viruses!

BATcher

Plethora means a lot to me.

Reply | Quote

Did Fred not glance at Wikipedia, where he would have found that ClamWin is the graphical/Windows interface for ClamAV, which has been running on Linux and many other operating systems for years and years – with rather poor virus detection results?

And that on-access real-time scanning for ClamWin and has been in development for more than six years.

Reply | Quote

This is an interesting and relevant article. I am a convert to MSE on Windows 7 PCs and when setting up new PCs rip out the trial versions of McAfee or Norton’s. MSE just does not give me support problems. The aspect I would love to see explored is the same tests with the Vista and XP operating systems and commentary on the suitability of MSE for these environments too.

Reply | Quote

This is an interesting and relevant article. I am a convert to MSE on Windows 7 PCs and when setting up new PCs rip out the trial versions of McAfee or Norton’s. MSE just does not give me support problems. The aspect I would love to see explored is the same tests with the Vista and XP operating systems and commentary on the suitability of MSE for these environments too.

The real differences I have seen are between single-core PCs and dual-core PCs. It’s like nightmare and daydream with MSE and Comodo, as well as (to some extent) Avast and AVG. MSE does a very poor job of handling single-core systems, in my experience. So do Avast and Comodo. Especially during boot times. And log offs, as opposed to system shutdowns. No exact numbers, but the differences are multiples, so no stopwatch is needed to see it happening.

Please note that I also run Acronis True Image Home, which does hang seriously on logoffs on my single-core laptop.

-- rc primak

Reply | Quote

People can think that MSE is a hog because at certain times it is active with a fair amount of cpu. But it is far lighter then Norton ever was on my systems. Mind you I have a few annoyances with MSE. It never seems to do the scheduled scans, then comes back and tells you that your system is unsafe because no scans were done. That’s pretty stupid. And that you frequently get asked in Windoze Update if you want the optional virus file downloads is just plain absurd. MSE should do its downloads without frequently asking (and sometimes it does do its downloads). And I wouldn’t mind if MSE would use less ram on low ram systems. But I have removed NIS and added MSE to every Windoze system that I have, old and new.

Reply | Quote

People can think that MSE is a hog because at certain times it is active with a fair amount of cpu. But it is far lighter then Norton ever was on my systems. Mind you I have a few annoyances with MSE. It never seems to do the scheduled scans, then comes back and tells you that your system is unsafe because no scans were done. That’s pretty stupid. And that you frequently get asked in Windoze Update if you want the optional virus file downloads is just plain absurd. MSE should do its downloads without frequently asking (and sometimes it does do its downloads). And I wouldn’t mind if MSE would use less ram on low ram systems. But I have removed NIS and added MSE to every Windoze system that I have, old and new.

I scan manually if the scheduled scans have not run. Don’t you, just for security’s sake?

-- rc primak

Reply | Quote

Thank you, Fred, for an intelligent and very well presented test.
That’s the kind of research i appreciate the most, since, like most computer enthusiasts, i want and need to know that kind of comparative information, but have neither the time, nor the resources to design and run. Very good stuff!

Presentation of the results : As you point out yourself in your article, Fred, showing some results as relative values makes everything remarkably clearer, and much easier to follow and digest. Maybe you could, in your next such project, extend this method to all the results. In this instance, ‘Startup‘ and ‘Shutdown‘ times would also have benefitted from the plus and minus relative output.

Reply | Quote

When I made my comments I didn’t actually thank Fred, but I need to say that was a very easy to follow presentation. I simply added my comments because I think I know why some people think MSE is a hog when it really isn’t. Of course, I would like MS to fix the few issues I reported.

Reply | Quote

Thanks for reporting on something that most reviews ignore. The only additional piece of info I would have liked to see was in the boot and shutdown times, what was the time for a system without an AM to get an idea of the the relative impact adding AM had. Not that I would suggest running without AM!

Reply | Quote

Thanks for reporting on something that most reviews ignore. The only additional piece of info I would have liked to see was in the boot and shutdown times, what was the time for a system without an AM to get an idea of the the relative impact adding AM had. Not that I would suggest running without AM!

Fred slightly hinted at a value around 8 seconds shutdown and 30 seconds startup for Windows without AV/AM.

-- rc primak

Reply | Quote

Thank you, Fred, for an intelligent and very well presented test.
That’s the kind of research i appreciate the most, since, like most computer enthusiasts, i want and need to know that kind of comparative information, but have neither the time, nor the resources to design and run. Very good stuff!

Presentation of the results : As you point out yourself in your article, Fred, showing some results as relative values makes everything remarkably clearer, and much easier to follow and digest. Maybe you could, in your next such project, extend this method to all the results. In this instance, ‘Startup‘ and ‘Shutdown‘ times would also have benefitted from the plus and minus relative output.

I think Fred implied or stated that for most measures, all results were relative to MSE. MSE was said to have had little impact on startup or shutdown times. Remember, these are times for virtual machines, which do not have to run POST or load up drivers from the hard drive during startup.

-- rc primak

Reply | Quote

Like Satrow, I noticed that the 1MB in “Avast consumed the least amount of RAM — 13MB less than MSE (which used about 1MB)” would appear to be a typo. Good article thought. I am relieved I don’t have to change my AV software!

Reply | Quote

Thanks Fred, great article!.
I think that limiting your testing to your stated objectives made your conclusions very powerful.
It seems that the most vociferous objections to your conclusions came from those that forgot your stated objective by the time they got to your conclusion.

Reply | Quote

“…those that forgot your stated objective…”

Or perhaps never read it in the first place. I’ve never seen a review of AV software which didn’t bring out people who act like the reviewer vilified their firstborn.

Reply | Quote

Don’t get me wrong….

I use MSE in my Netbook, BUT I just can NOT allow it to auto-load.

In this Lenovo S10-2 – If I permit it to autoload, I end up with TWO icons in the bottom right corner of the screen, and ONE of those icon sits RIGHT ON TOP of another program icon – it varies as to which one is “squashed” – but it can’t be got rid of and then display the “sat-upon” icon!

The only way to show show this hidden icon in these circumstances – is to “Terminate MSE with Extreme Prejudice” and restart MSE – That’s silly & annoying too!

I suppose I could seek out a program which will enforce the loading of MSE till last – but why should I have to?

Reply | Quote

Loved your analysis of the free AV software.

Can you do the same performance testing for the paid security suites?

Reply | Quote

Mr. Langa, I am surprised at you…..a man of your experience……….over the years we have tried all the AV’s that you “tested” with the exception of the ClamWin and we now use Avira mostly due to its very pro-active real time protection. When we saw the immense amount of memory usage you posted for it when compared with the other programs we wondered why such a disparity with Avira and Comodo versus the others until we realized that we were quite famiiar with that amount of memory usage by Avira when it is ACTIVELY SCANNING, certainly not when at idle with or without real time engaged (on our fastest pc, about 136mb scanning, and about 33mb at start up, dropping to about 15.5mb at idle) Updating, either automatic or manual obviously increase resource usage as well and will drop back down after.
As well we wondered about Comodo (a fine program as well), so we actually took the trouble and loaded it on a pc and checked it and guess what? We got similiar memory usage to your chart when it was ACTIVELY SCANNING with a similiarly corresponding drop similar to the Avira as we expected when it was at idle. So we have to ask, what were you thinking?? You must be aware that these types of security programs usually update and scan automatically by default unless you change this behavior in options. Maybe you were trying to do too much at once to notice. Didn’t you think it was strange? If you were going to truly test memory footprint head to head you should probably have set the program options to be as alike as possiible. In any event, on our slowest pc’s we get boots of about 30 to 45 seconds and about 20 seconds on our multi-cores with Avira so we cannot speak to the inordinately long count you received. Maybe you have a lazy raid card or something, but for the reasons here in described, we have decided you must rush to the health food store and buy a small barrel of gingko biloba as soon as possible………then re-run the test………..other than that, we think you’re a great guy and a role model to us all, seriously.

Reply | Quote

“Avast consumed the least amount of RAM — 13MB less than MSE (which used about 1MB). AVG and ClamWin were on par with MSE, but Avira used a whopping 139MB more.”

I’m confused. If MSE uses 1MB of RAM and Avast uses 13MB less than MSE, are you saying that Avast creates 12MB of RAM??? What am I missing here?

Reply | Quote

Very informative article. Fred: thanks for the time and effort you put into it. I have one related story – about security software and time – and one request for further study.

Related story: Ad-Watch Live

In August, 2010, I submitted this post – http://www.lavasoftsupport.com/index.php?showtopic=29733 – about Ad-Watch to the Lavasoft forum. It describes how I wrote a program to time the effect Ad-Watch had on starting up one particular program. You can read the timing details there; the executive summary is that the impact was so onerous that I stopped using that product. (Ad-Watch has since moved on to another major release version, but no one from Lavasoft, or anyone else, ever responded to my comments.)

Request Related to Article:

In large measure as a result of Fred’s recommendation, I switched last year from Trend Micro’s security suite (when my subscription was winding down) to MSE and the free version of ZoneAlarm’s firewall. That was an acceptable combination, which I used for half a year or so. I switched from that combination a few months ago to the free version of Comodo’s AV and firewall (for no great reason – just wanted to try an integrated suite, and it seemed to have better protection-related reviews than my MSE/ZA combination).

That’s the background. But one problem I am having with Comodo AV is that the scan’s seem to take too long, to the point where I’ve changed their frequency from nightly to weekly. So, I wonder if you, Fred, could augment your report with some methodology that also takes into account scan time. (In my case, I’m running Vista Home Premium, Intel Quad Core Q6600, 3GB RAM, and about a half-full 300GB drive.)

Regards,

Bill P.

Reply | Quote

Hi Fred,

Thanks for an excellent article. A year or two ago, I made the switch from AVG to MSE because AVG seemed to be getting very porcine. Looks like it wouldn’t have made as much difference as I thought.

One measurement I would like to see is a measure of ‘random’ resource usage spikes. (I have no idea how you could measure this.) It seems that every once-in-a-while MSE suddenly starts sucking up nearly all my CPU cycles, and brings everything else to a crawl. This usually lasts from several seconds to several minutes. I don’t believe it is associated with updating or with scheduled scans, but I have no idea what else it might me doing. I most often notice it when scrolling a window becomes impossible and my disk access light goes nearly solid ‘on’.

If you figure this out, I think it would be an extremely enlightening column to add to your chart.

Reply | Quote

Hello Fred!

First off, I’d like to thank you for being a constant “companion” to me from windows 98 and on. You never failed to keep me informed on how to keep my computer running well. When I was a cable internet installer, I often suggested your Langalist to folks who were not computer-savvy and wanted to learn to be. I felt your resource was the best on the Internet.

Initially, when I read your recommendation on MSE, I did want to give it a try. however, since I live in the Ukraine (I have a native wife and daughter), we got our new computer with Windows 7 Home installed on it (we could not afford anything else). Unfortunately, MSE will install according to the Window’s language in use. I cannot change it so I am left with Russian (which I cannot understand). Because of this, I uninstalled MSE regretfully. The time it was running, I did not perceive any slowing of my system (disk, ram, etc).

I wanted to know if there is some way I can get English instead of Russian? I know loading a difference language will cause Windows 7 to be flagged as not genuine because of some program in Windows designed to validate by checking language files checksums. Using a translator is equally not good because you cannot copy any dialog boxes. Previously there was software that would do this, but Microsoft has closed that route also by preventing such software form working in windows 7. From all thatI could learn, it seems Windows has 100% prevented using any other language on a home system except the one in which it was purchased (and the Windows serial number is connected to).

My question to you is, is there ANY provision for changing this? Will Microsoft show mercy on folks like me and allow English only instead of the Russian language on my system? We are very poor and cannot afford anything. (we live on my wife’s disability which doesn’t cover much). I cannot even buy another year of Windows Secrets.

Thank you very much for your Time, Fred. God bless!

Jory M. Earl

Reply | Quote

Shalom Fred and everybody,
I have added MSE as soon as it was released. After some time and some tests I uninstalled first Avast and then AVG (I kept both running as a double security measure). Operation improved dramatically. I did try Avira some time ago, and let it go to neverneverlands.
I still hang on to Ad-Aware and once a while I do a fine combing with malwarebytes, hardly find anything suspicious.

A suggestion, instead of using your manual stopwatch, try using Soluto. 🙂
Worth also to be recommended at Windows Secrets.
yours laksi (aka Yaakov Laks)

Reply | Quote

I am the anti-virus guy for a hospital in the midwest. We’ve been using McAfee since before I got here a long time ago. I know that it uses resources and that everyone has it to complain about for slowness or whatever else happens on their PC. I know there are people that are loyal to brands, and I am as guilty as anyone, but do not have the depth of experience to be objective.

I really like your comparison and methods. I sure wish I knew of a place/organization that would do similar for Industry level commercial software.

Does anyone know of such?

Thanks.

Great job Fred.

Roger

Reply | Quote

I was surprised to read about someone having issues with Microsoft Security Essentials. I’ve been using it since it was still in Beta and have never had any startup or performance issues. My usage experience has been on XP, Vista and Win 7. It’s on all my personal PC’s and I’m not even sure how many customer machines I’ve installed it on. I’m quite confident that when used together with Malwarebytes Antimalware a Windows computer is as protected as it can get. It’s a good idea to enter the MBAM executables in the MSE Excluded processes list. The MBAM forums show how that is done.

Reply | Quote

My wife has a notebook with Windows 7 and I am thankful for this article. How about duplicating it for my XP system – with the most popular tools for that environment + plus perhaps a suprise or two.

Reply | Quote

Lately I have been plagued with computer or application stalls where the new circling hour-glass pops up instead of the function I clicked. If I get impatient and click again, the scree goes dull and I cannot do anything until this clears.

After reading the article, I am wondering if this apparent random lockup is due to my Windows 7 setup which uses both of MSE and AVAST?

Thanks; Chuck

Reply | Quote

Why would you ever use 2 AV products at the same time on the same PC? Never, Never, Never. They are both looking at the same resources and doing the same thing. One of them has got to go!

Reply | Quote

Chimo makes a good point about measuring the effect on applications and that you only boot once a day (or once a week in my case since I use hibernate). Fred, would it be possible for you to run your favorite office applications benchmark under each different AV program?

I can’t agree with Chimo however that MSE provides more comprehensive protection than free anti-malware programs (anti-virus is really a misnomer nowadays but is one the customers are familiar with). Yes, Kaspersky at as little as $30 for a 3 user license, probably provides the best overall protection but I still find that it slows down many systems significantly, some to the point of unusability. It also suffers from poor user interface design for non-technical users. Norton, is just as cheap, has a great user interface, and has greatly improved both detection rates and performance in the last two years, since Enrique Salem returned to take charge of it (refreshing to find a software company run by a developer rather than a marketing guy). I would love to see how these two compare in your tests.

Reply | Quote

I really don’t care how long it takes when I boot, and certainly not for shut down.

I just make coffee after I turn on the PC. Often eat breakfast too before I start actively using teh PC.
When I shut down I only need to come back later and make sure the PC is actually off and the shutdown didn’t hang trying to close a hidden pdf remnant or IE had problems again.

What is a really a problem is when the AV interferes with what I am actively doing and slows things down too much.

As long as hotmail requires javacrap no AV will be sufficient for protection.
I just got hit by a scumware attack that slipped in that way.
VFF.exe installed itself and added itself to start up and would not let me erase it.
Kept coming back every time I removed it.
If a long boot up would catch such things and remove them it would be worth the wait.
Fortunately I have other methods of dealing with such scumware, and winpatrol told me it was there so I knew to rip it out by the roots before the machine was shut down and restarted.

I already block flash, activex, and other such security holes so I can avoid problems instead of fixing them later.
It would be great if javacrap could be killed off too.

A program like winpatrol that alerts me to changes to startups or the registry is much more useful and faster.
Other programs block activex without my permission.
And various batch programs can handle rootkits and other tougher problems like the VFF.exe phoenixbird like mode.
Those programs that flag bad websites too often have false positives and offer little value.

In the 1980s I developed a virusproof pc. So did another company for a usaf contract.
Could not sell it to anyone. I could architect a 100% totally scumware proof pc, but will not waste my time as long as people prefer to fix problems instead of avoiding them. Unfortunately no addons will ever fix problems that must be avoided by a proper systems architecture and design of the pc hardware and software.

Reply | Quote

Gee Fred, measuring quantities and posting facts is no good. We need rumors and opinions like everything else on the Internet!!
Great article and thanks for debunking the rumor-mongers.

Reply | Quote

Gee Fred, measuring quantities and posting facts is no good. We need rumors and opinions like everything else on the Internet!!
Great article and thanks for debunking the rumor-mongers.

Actually, Fred did a great job with this half-baked article – it appears to have been highly successful in drawing new people in to the Lounge.

Reply | Quote

Fred, Did you check and make sure the start up type was automatic and not automatic (delayed start)?

Reply | Quote

Just wanted to comment that I’ve also wondered why Fred always recommended MSE. Each time I’ve installed it I’ve ended up replacing it with AVG or more recently with Avast, because of the extreme change in system startup and also noticeable slowdowns to the point of almost lockups. I had tried version 1 and had these problems. When version 2 came out and Fred was still recommending it I tried it again, and had the same results. Although I haven’t done controlled testing such as Fred did for this article, I can guarantee you that MSE is a “pig” on the systems I’ve tried it on. My only explanation is that all of the computers that I’ve installed MSE on were older systems (more than 5 years old) and all were running Windows XP SP3, with anywhere from 500 MB to 2 GB of ram. All solid computers running Office 2003 era programs. The worst case was a Dell that had 500 MB of ram, but even if this wasn’t the fastest computer in the world, it ran ok with AVG, but was almost unusable with MSE.

Reply | Quote

Did you say XP? No, Fred didn’t test on XP. He never claimed to have tested under XP. Who would? NO ONE SUPPORTS XP anymore worth talking about.

Reply | Quote

Did you say XP? No, Fred didn’t test on XP. He never claimed to have tested under XP. Who would? NO ONE SUPPORTS XP anymore worth talking about.

Interesting comment on 2 points:
1. Fred said in his summary:

And on most systems, it has little effect on system resources.

, which is obviously incorrect because the test was not run on the most popular Windows version, XP.
2. XP will be (note the use of future tense) supported by MSFT after it stops support for Vista.

Reply | Quote

What’s more important resources used or protection furnished? To me it;s protection!

Since Norton cleaned up it’s act in 2010 or maybe 2009, I have stuck with NIS!! :fanfare:

I also run MalwareBytes Pro, Super AntiSpyware, and Prevx On-Line Safety (Free from my bank).

So, I do have multiple layers of protection. And they all live together with no conflicts on Win 7 and a 6 year old Dell Dimension E520
desktop.

And Secunia PSI keeps me alerted!!

Reply | Quote

All this anguish over getting free Internet security is badly misplaced. There’s no need to ever pay more than sales tax for Internet security, including such resource sippers as Norton Internet Security. Norton, Kaspersky, and other “for sale” Internet security programs are free, or nearly free, when purchased with rebates. I haven’t paid more than sales tax for any Internet security program in over 15 years. Nearly every week frys.com has Norton, Kaspersky, or another quality Internet security program available for free after rebates, leaving you only with the cost of sales tax. And I have had no problems with receiving rebates in over a decade.

These rebates make buying Internet security program a bargain. And for those Norton haters (and I had been one), Norton Internet Security was rewritten from the ground up and, as every review has noted, it is no longer a resource hog. So if you want a really top notch Internet Security program, check visit Frys.com and sign up for its weekly sales (or check you local newspaper every Friday if there’s a Frys Electronics store in your metro area). If you plan ahead, you’ll never have to pay more than a few dollars for Internet security again.:rolleyes:

Reply | Quote

Thanks for all the comparision tests on free antimalware. Thanks to you, and a new version of my paid AM that crashed rather than installed, I switched to MSSE. Everyone needs to know that the software takes a while to settle down. After install and updates, and a good full scan, its running but with lots of background activity. Within a few days and reboots it settles down.
As a bonus, Microsoft software updates are smoother with MSSE on than other AMs off.

Reply | Quote

I’m going to agree with Bill Garfield. I removed MSE because my computer bogged down when it updated. I would have kept MSE if I could control when it updates (once a day, not several times a day). It’s too bad Fred tested the software on clean, plain systems. How about testing on computers that have a bunch of programs running, etc? I know my computer is a little dated (xp pro sp3, 1.6 Ghz, 1 gb ram) but it shouldn’t come to a standstill with any AV.

And, bfbrooke, I have tried every free AV out there. I’m not happy with any of them so I don’t use any. And before anyone responds, I’m a systems programmer with 12 yrs experience and I haven’t had a virus/malware problem for over 10 years.

Reply | Quote

Thanks Fred for your comparisons.

With my customers mostly in the over 55 ag group and many with limited finances, their security is mostly handled by free products.

Previously most have been using free AVG but since your earlier recommendations I have been changing them over to MSE with very good results.

It’s quieter, simple operation has been great.

I take it that you will be monitoring the progress of ClamWin as it approaches and after release, and we may hear from you on this matter at a later date.

Ken Farlow
Cornerstone Computer Connections
New South Wales
Australia

Reply | Quote

Further to my previous.

Most of my MSE users are single core XP machines (PIV or equiv.) with 2GB RAM and are getting good results.

I haven’t been receiving calls about poor performance.

Reply | Quote

Hi Fred,

I’ve been a long time admirer (since the Langa List days). In this case, your test procedure was sound, but may have missed the mark so to speak. I have tried all of the free AV products you tested (and more). My search for a truly light-weight AV product was spawned by the fact that I was (until very recently) running some computers that were quite old. They worked just fine for most purposes, but didn’t have the CPU power of today’s machines. I did everything I could to eliminate automatic start-up programs, boost RAM, regularly defrag the HDD, etc. to keep them running as nimble as possible. What finally caused me to abandon those machines however, were the AV programs.

What I found happening over and over again, was that the AV product seemed to run great when it was first installed, but it was the second, third and fourth boot-up of the computer (on the second, third and fourth day after install) that was the REAL problem. In point of fact, it was the automatic virus definition update process (which always occurs during the boot-up sequence) that bogged the machine down to a standstill. Generally, the CPU would max out, essentially locking up the machine for minutes until the update process was complete. By ignoring the update process in your tests, you merely duplicated my first days success, while ignoring my ongoing tribulations.

I eventually chose to take my chances and run my oldest machines without ANY real time AV protection (ie, ClamWin fits the bill). Boot time was only about 1 minute-30 seconds. I just couldn’t take the aggravation of a multi-minute boot-up waiting for new virus definitions to load. Now that I have more up-to-date machines, I’ve found that I like MSE best over all the rest. AVG, Avast, Avira and Comodo seem to have really gotten bloated over the years. MSE is effective, unassuming, light on resources, and… it’s free! What’s not to like?

Jim (Murfreesboro, TN)

Reply | Quote

I for one appreciate the amount of time and effort to accomplish the test. I am sure most others do as well. Thanks Fred for making / taking the time. It was very professional.!

Reply | Quote

Hi Fred,

I install MSE on a lot of PCs. I have found, however, that on many machines, it can slow things to a crawl. The cause if this is, by Microsoft’s own warnings, that Microsoft Security Essentials doesn’t like any other malware applications running at the same time, such as Malware Bytes or Super Antispyware. I have found this to be true on most, but not all XP operating systems. Other XP installations seem to work fine with other malware programs, such as these installed. By the way, the other malware programs don’t need to be running in the backround; just installed on the PC. When I find a PC that is adversely effected this way, I then uninstall MSE and install Avast! instead. This may have already been pointed out in the many postings on this subject, as I didn’t read all the posts.

Reply | Quote

I just had the resource issue on a WIn7 64 bit machine – PC keep getting slower and slower to the point usefull work was not possible. Using MSCONFIG I saw that the CPU was 98% used, and the culprit was ZA. I looked on the web and saw that VSSMON (ZA) had a history of this issue, uninstalled ZA and what a difference.

Reply | Quote

Fred, I think your AV comparative tests suffer from an incorect assumption. You say:
“I started timing when I launched the VPC, then paused the stopwatch when the Windows logon prompt appeared. After entering my user name, I simultaneously hit Enter and restarted the stopwatch. I kept the stopwatch running until the notification area was fully populated, all subsystem icons (sound, networking, and so on) were up and active, and all desktop icons appeared.”
However, in my opinion, you should have waited until Task Manager showed a return to minimum RAM use, usually around 5%, since I have often seen high values long after “the notification area was fully populated, all subsystem icons (sound, networking, and so on) were up and active, and all desktop icons appeared”, and many times it’s specifically the AV itself using these resources, with db updates or some initial scan.
What’s your take?
Peter.

Reply | Quote

Very good article. I will try MSE on one of my systems.
I’ve used several security suites over the years. Are they different than just the Antivirus?
One thing I would’ve liked to see was CPU usage when in ‘idle’ mode after boot-up. I had purchased BitDefender (supposedly the best ‘for money’ security suite) and tried to run it on a slower (Pentium 4) system. Terrible CPU usage – averaging 25-30%. I ran into Vipre – a built from scratch package – which ended up taking between 5-10% CPU. I realize Fred’s article was addressing only ‘free’ software .. but the CPU usage parameter would be interesting to see for those six packages.
And if a security suite performs differently than just the Anti-virus, I’d like to see a similar set of tests with a full-blown security suite .. the free ones of course.
Appreciate the work you folks are doing, Fred ..

Reply | Quote

I read the article with interest, because, I, too, changed to using MSIE at Windows Secrets recommendation. When I first installed it, it was truly AWFUL and my computer slowed down almost to a standstill. Some investigation revealed that MSIE was spending most of its time scanning my firewall log files – when I excluded these, MSIE faded into the background and has not been a problem. If the test had used a PC with a firewall, the results may have been quite different.

Reply | Quote

What is often missing in articles regarding software applications is the issue of accessibility. Specifically, access with screen reading software for users with low vision or blindness. I have been in the business of building and configuring computer systems with access technology long enough to remember using CP/M and Apple Dos 3.3. (Yes that’s Apple II) Within that time advances in speech and screen reading technology have come close to catching up with the latest user interface to grace the screen but never completely. When it comes to anti-virus software accessibility simply never seems to be considered. Almost all AV applications use some form or another of the graphic-click-to-do-anything button. Of course this means that people using screen reading software are either restricted in their use of the program or simply can’t use it at all.

We have tested the common free and otherwise AV packages and with the exception of Microsoft Security Essentials (and the promising Clamwin) found none that would provide enough functionality for access with a screen reader. There is certainly more form than function with all those color gradients, shimmering icons and cute bars running across the screens. Clearly the eye-candy has little to do with the efficacy of the product itself.

When Windows Defender was first introduced we finally had an accessible piece of anti-malware software and when MSE was released it just got better. The fact that it’s free is icing on the cake. MSE can be installed and used with screen access software unlike the other packages that use some form of HTML or other graphics screens.

I commend Microsoft for their MSE product and sticking to some of their own standards. Accessibility in MSE is far from perfect but it works and that says a lot more than anything that can be stated about the other products. With Clamwin coming into the mix there may now even be some choice available for people using screen access technology.

Reply | Quote

Some folks just think they know more than the experts no matter what the subject is. You could be digging a post hole or replacing a power supply in a pc and your doing it all wrong in their view. There is nothing wrong with that mind you as you may just learn something new sometimes, maybe, depends…? I always listen to any opinions. My dad taught me that a long time ago!

I run my own in home computer business building custom desk tops, manly hi-end gaming machines. My customers will ask me how much anti-virus software will cost, I simply tell them its free……All my machines went out the door with Avast, until MSE came along. It runs quiet, lean and clean. My machines boot in less than 30 seconds.

Reply | Quote

Good article and appreciate the information. Have you provided information about the difficulties of removal of various AV products? We know that removal of any software has the potential to leave pieces almost anywhere. I worked on a PC where I had to remove AVG. It caused major headache with windows update that even after the normal removal process, I had to do major surgery to fix the issue.

Installation of these tools is far from a novice’s grasp. Sometimes there are options to customize what is installed. Other times, you have no choice to have things installed that you do not even know about.

So I guess I can add that as another question. Any information about the robustness, hidden “feature”, common gotchas, major headaches?

I am currently using CA Internet Security Center. Not because I like it but it was provide free from my ISP. Since I had no love for anything else I have tried (free or paid), this one has yet to become an issue for me, mostly, and provides enough protection that I can deal with it.

Your thoughts always appreciated.

Reply | Quote

gemachte,
Look at the third paragraph link of the post by hdonnell (post #99). This addresses the COMPLETE removal of most AV products.– http://answers.microsoft.com/en-us/protect/forum/protect_start/list-of-anti-malware-program-cleanupuninstall/407bf6da-c05d-4546-8788-0aa4c25a1f91 —

Reply | Quote

Good article and appreciate the information. Have you provided information about the difficulties of removal of various AV products? We know that removal of any software has the potential to leave pieces almost anywhere. I worked on a PC where I had to remove AVG. It caused major headache with windows update that even after the normal removal process, I had to do major surgery to fix the issue.

Installation of these tools is far from a novice’s grasp. Sometimes there are options to customize what is installed. Other times, you have no choice to have things installed that you do not even know about.

So I guess I can add that as another question. Any information about the robustness, hidden “feature”, common gotchas, major headaches?

I am currently using CA Internet Security Center. Not because I like it but it was provide free from my ISP. Since I had no love for anything else I have tried (free or paid), this one has yet to become an issue for me, mostly, and provides enough protection that I can deal with it.

Your thoughts always appreciated.

While this is beyond the resources of Windows Secrets, there are good comparative reviews of free and paid anti-malware products in most of the main tech sites. PC Magazine has a reasonably comprehensive series of reviews here . A Google Search shows others.

-- rc primak

Reply | Quote

Starup time with some good virus software can be affected by malware and other software on a system, so do your tests on a clean system.
Some virus infected systems will cause the antivirus software to attempt to remove it at system startup, so maybe this chaps system has got something wrong with it.
AV programs that do not detect some malware at startup could be quicker when malware is present.
Thanks to Widows Secrets for good ligic in their tests.

Reply | Quote

Let me say first an excellent review of the Resource usage for current free AV tools out there. It is always good to know which present specific loads on a system.

I have been using MSEE on a few systems for a while now and generally I don’t find it “heavier” on a system with one exception.

I have had it running on a couple of Win 7 Laptops one running Pro 64 bit and one running Home premium 32 bit. On both of these machines which are intermittent usage machines I noticed the same behavior.

When these machines had sat for approximately 1 week or more and the definitions had reached an out of date point. The machine on Login would exhibit high CPU usage and become unresponsive. In both cases they would exhibit extreme sluggishness and the operator could not get to Wireless connections to establish either a learned or new Wireless connection.

I know it was MSEE because on both machines it was showing nearly max CPU usage. I could kill the MSEE processes and the machine would become responsive allow you to connect the wireless and then at some point MSEE would re-enable and it would update.

It happened on numerous occasions until I replaced MSEE on those laptops.

I think what was happening is MSEE was trying to force an update due to the out of date status and since it could not find a network connection would tend to just hang.

I have multiple desktops and even laptops that generally sit on a wired network that I have not had the occasion to experience what I described above and in those cases continue to use MSEE and it has not failed me.

Anyway in the case of an intermittent use device especially a laptop I do not typically recommend MSEE but rather one of the other free tools out there.

Hope this is informative.

Reply | Quote

I have been very happy with MSE because it never causes problems with other programs as Norton, for example, sometimes did. On my older computer, which has Vista Home and Premium, MSE does take quite a long time to come up. A full boot-up when the computer is first started can take almost two minutes. But I bought another computer (both by HP,incidentally) which is on Windows 7. On that computer the boot-up is almost instantaneous including MSE. So you just cannot generalize. The older computer, which I normally use, does have more programs to boot although I try to keep them at a minimum. My conclusion, and I am no expert, is that MSE as such is not responsible for slow boot times, but it may be slow to come up in association with other programs, or perhaps in relation to the particular version of Windows.

Reply | Quote

The greatest mistake a system administrator can make is to assume that their configuration is “the best”, and that if there are performance problems, it must be the fault of some piece of software. There’s way too many combinations of software, hardware, network, etc. that can effect the performance of your system. WS in general, and Fred specifically is meticulous in his methodology for testing the effect of products on a running windows OS (and that has been proven over a number of years and different variations of windows). His recommendations are spot on. If it doesn’t work on your system, it’s probably something you have done to your system that is causing the problem. There is no vendor or lab that can test every combination of “stuff” and make it work efficiently on every system. People that whine about their experience just haven’t done enough homework to diagnose the problem. Thanks, Fred…

Reply | Quote

The greatest mistake a system administrator can make is to assume that their configuration is “the best”, and that if there are performance problems, it must be the fault of some piece of software. There’s way too many combinations of software, hardware, network, etc. that can effect the performance of your system. WS in general, and Fred specifically is meticulous in his methodology for testing the effect of products on a running windows OS (and that has been proven over a number of years and different variations of windows). His recommendations are spot on. If it doesn’t work on your system, it’s probably something you have done to your system that is causing the problem. There is no vendor or lab that can test every combination of “stuff” and make it work efficiently on every system. People that whine about their experience just haven’t done enough homework to diagnose the problem. Thanks, Fred…

Mark Twain said “It’s not the things you don’t know that can hurt you, it’s the things that you know for sure that aren’t true”

Reply | Quote

Let me start of by saying your article is an interesting read.It’s nice to see someone actually trying these programs and comparing them the way the article explains. I do have some information from my experience to share that may contribute to the issue from a different angle than just testing startups and shutdowns. I think that the term “resource pig” is a vague term that i use only in specific circumstances and shut downs and startups aren’t related to that term for 1 reason, during the shutdown/startup windows is runninng the processes either turning them off or launching them. the term in my line of work relates to the everyday running of the program endlessly during the whole time the computer is on and consumes 1 or both of 2 things. cpu usage and memory space. Now to my experience: I work in a tech support field with a company of about 600-700 employees doing remote tech support and what i have come across regarding customer complaints of “sow performance” is a number of either glitches or unknown tasks that antivirus programs do or have. Now this is barring any other issue and i’m just talking problems that have been discovered and resolved and they turned out to be a result of an antivirus program process consuming all the cpu usage ( which is the most common cause in these cases). For example All versions of AVG free or paid which have the identity protection has locked up a computer at 1 time or another and this is a known glitch that you can find a resolution for in the avg forum if you want to dig a little (avg doesn’t have the best forum to find answers to problems). The only resolution found to date to resolve the issue is to turn off the identity protection in AVG, reboot the computer then to turn it back on. I get call after call with this type of complaint and after checking Process explorer only to find out that AVGIDSagent.exe is using 100% cpu this is the only resoulution. i think this is what people are talking about when they say “a program” is a resource pig. i found Norton products to perform similarily and Microsoft security essentials. I have not found Mcafee, Kaspersky, or Aviria to do this. What it comes down to i think is the definition of “resource pig” in the end but what i do recommend in the end is try a product, If you don’t like the way it performs or if you find it slows the computer down then change products and do this until you find something that works for you.

Reply | Quote

What it comes down to i think is the definition of “resource pig” in the end but what i do recommend in the end is try a product, If you don’t like the way it performs or if you find it slows the computer down then change products and do this until you find something that works for you.

That’s a good bottom line, Steve!

Reply | Quote

As a technician I agree with you reguarding MSE. Except when using Windows XP. It would be interesting to see your tests repeated on Xp. My experience has been that Avast has less effect on the perfomance of Xp than Mse. After installing MSE on several xp machines it soon became obvious that there were issues with overall performance. I cant remember if it affected startup much or not as I havent put it on xp for some time now. It just was not worth it. Taking Mse off and putting Avast on instead improved computer performance considerably. On Vista and Windows 7 I use MSE all the time unless my client wants something else but most are happy to go with my recommendation.

Reply | Quote

Fred, the problem is not with Win7 but with XP. I have both set up as a dual boot situation on the same computer obviously, and XP is severely slow in booting with MSE installed.

Regards

Errol Greer

South Africa

When are you going to visit us !!??

Reply | Quote

You apparently tested your AV programs on a Win7 system. I am using MSE on my Win7 machine with no ill effects, but my WinXP machine is a different story. It takes anywhere from 2 to 5 minutes for my system to stabilize enough to open any programs. The culprit is an executable, MsMpEng.exe which I can watch in Task Manager eating up 90+ % of my system resources for several minutes. This file is not present with Win7 machine. MSE is a resource HOG on an XP system.

T. Walsh

Reply | Quote

Great column re resources…….any thoughts on pc doctor??

Reply | Quote

Great column re resources…….any thoughts on pc doctor??

Is that PC Doctor or Spyware Doctor (from PC Tools)? Different programs with very different reputations.

-- rc primak

Reply | Quote

What about Windows Defender.

Reply | Quote

What about Windows Defender.

For Windows XP/2003/Vista/7, Windows Defender (antispyware) has been superseded by Microsoft Security Essentials(antivirus/antispyware).

For Windows 8, Windows Defender is very similar to Microsoft Security Essentials.

Bruce

Reply | Quote

For Windows XP/2003/Vista/7, Windows Defender (antispyware) has been superseded by Microsoft Security Essentials(antivirus/antispyware).

For Windows 8, Windows Defender is very similar to Microsoft Security Essentials.

Bruce

Actually similar, but not very similar. They’ve put in quite a few improvements. ( DETAILS )

-- rc primak

Reply | Quote

Actually similar, but not very similar. They’ve put in quite a few improvements. ( DETAILS )

The engine, definitions and interface are identical. I can only see that boot time may be quicker. What are the other improvements?

Bruce

Reply | Quote

The engine, definitions and interface are identical. I can only see that boot time may be quicker. What are the other improvements?

Bruce

Agreed Bruce. The Win8 Defender uses identical engines and definitions to MSE on Win 7, see attached side by side:

30341-Win-8-Defender-vs-Win-7-MSE

What the referenced article suggests (after the detail about ASLR improvements) is that Windows Defender, as opposed to MSE, has significant improvements. It could be argued that if one upgraded Windows Defender on Win7 to MSE, then the same improvements would be delivered. Nice marketing angle for Win 8 though.

Interestingly the version number for Win 8 defender is the same as the OS version number for the CP.

Not sure how this will work with the current MSE licence restrictions for business use. If Windows Defender is to be shipped as part of the Win 8 OS, are we allowed to use it on more than 10 devices in a business environment, while for essentially the same product in Win 7, we are not?

Reply | Quote

Agreed Bruce. The Win8 Defender uses identical engines and definitions to MSE on Win 7, see attached side by side:

30341-Win-8-Defender-vs-Win-7-MSE

What the referenced article suggests (after the detail about ASLR improvements) is that Windows Defender, as opposed to MSE, has significant improvements. It could be argued that if one upgraded Windows Defender on Win7 to MSE, then the same improvements would be delivered. Nice marketing angle for Win 8 though.

Interestingly the version number for Win 8 defender is the same as the OS version number for the CP.

Not sure how this will work with the current MSE licence restrictions for business use. If Windows Defender is to be shipped as part of the Win 8 OS, are we allowed to use it on more than 10 devices in a business environment, while for essentially the same product in Win 7, we are not?

TintoTech —

A lot of folks are confused in the same way you and BruceR seem to be. In Windows 8, Windows Defender IS the upgrade from MSE. On Windows 7 and earlier, MSE WAS the upgrade from Windows Defender. Two very different uses of the same title. Microsoft has rebranded their antimalware at least four times in four Windows versions, and so this can get very confusing. Windows Defender for Windows 8 is NOT the same as Windows Defender for Windows 7 and earlier. Confusing enough?

In your side by side, look at the antimalware client version and the program version. They are very different.

-- rc primak

Reply | Quote

Yes, I agree it is very confusing, and not entirely clear (perhaps purposefully because of possible anti-trust restrictions in some parts of the world?).

If the antimalware engine has identical version numbers in each product then the antimalware capabilities of the product must be the same, unless the signatures provided to each product are different (which they are not).

The wrapper around each antimalware product may be different, but the core antimalware capabilities must be the same.

Windows 8 does indeed provide core enhancements and additional layers of protection, but the anitmalware engine is the same.

I too observed the different program version numbers, as noted in my post. But look more closely. Do you see anything interesting about the version number of the Windows Defender program in Win8? It is the same as the build number of the OS. That cannot be by chance and leads to further confusion about what the product actually is.

It is still my contention that in terms of antimalware, Windows Defender in Win8 is a re-badged MSE. Since it has a different wrapper, it can leverage some of the security improvements of the core OS, but the antimalware engine versions are still identical.

In any case, all that was leading up to my real point in my last comment: it appears we can use Windows Defender in Windows 8 unrestricted as it provided as part of the build. However, the antimalware engine, which is identical to that in MSE, can only be used on up to 10 devices in a business environment when deployed under the MSE wrapper. That appears to be inconsistent and it will be interesting to see how it develops. I suspect the antimalware industry is also looking closely at that too.

Reply | Quote

According to the page referenced in DETAILS in my previous post, here are some improvements in Windows Defender for Windows 8:

“ Improved protection for all types of malware “. (Reread this section in its entirety.) Highlights include:

UEFI Safe Boot integration, dramatically less impacts on system performance (which I have personally seen), leveraging the other Windows 8 kernel-level, heap, ASLR and Smart Screen security improvements.

I did re-read that section of the DETAILS article; but apart from the secured boot those improvements are not in the Windows Defender section, being general Windows 8 features.

The engine is not quite the same as MSE, as stated in the article.

The article doesn’t state that at all.

In a comment at the bottom of the article, a Microsoft Windows 8 team member states that the engine is identical:

Microsoft Security Essentials will not be needed on Windows 8. We remain committed to providing strong protection of Windows 7 and earlier Windows users with Microsoft Security Essentials. Both are based on the same core technology (engine, signatures, filter driver), but Windows Defender on Windows 8 also provides additional functionality, such as integration with Windows 8 secured boot, as described in the blog.

The look and feel of the user interface are what the article says are similar if not identical. And in this I concur.

The article doesn’t refer to look, feel or user interface anywhere.

I’m not sure if you have grasped that the article itself was only comparing Windows 8 Defender with Windows 7 Defender; not Microsoft Security Essentials, which isn’t mentioned once.

TintoTech —

A lot of folks are confused in the same way you and BruceR seem to be. In Windows 8, Windows Defender IS the upgrade from MSE. On Windows 7 and earlier, MSE WAS the upgrade from Windows Defender. Two very different uses of the same title. Microsoft has rebranded their antimalware at least four times in four Windows versions, and so this can get very confusing. Windows Defender for Windows 8 is NOT the same as Windows Defender for Windows 7 and earlier. Confusing enough?

Neither of us exhibited any confusion on those two points.

I still maintain that Windows 8 Defender is very similar to Microsoft Security Essentials.

Bruce

Reply | Quote

I did re-read that section of the DETAILS article; but apart from the secured boot those improvements are not in the Windows Defender section, being general Windows 8 features.

“Microsoft Security Essentials will not be needed on Windows 8. We remain committed to providing strong protection of Windows 7 and earlier Windows users with Microsoft Security Essentials. Both are based on the same core technology (engine, signatures, filter driver), but Windows Defender on Windows 8 also provides additional functionality, such as integration with Windows 8 secured boot, as described in the blog.”

Neither of us exhibited any confusion on those two points.

I still maintain that Windows 8 Defender is very similar to Microsoft Security Essentials.

Bruce

That is exactly the claim I said they made — namely, that “Windows defender on Windows 8 also provides additional functionality…”. I am only quoting Microsoft on this point, as I have not reverse-engineered the new Windows Defender Engine.

Even the comment cited does not state that the engines are the same. How similar they are, I cannot definitively say, since I have not reverse-engineered the engines.

-- rc primak

Reply | Quote

How similar they are, I cannot definitively say, since I have not reverse-engineered the engines.

Stop telling us they’re different then. 🙂

Bruce

Reply | Quote

Stop telling us they’re different then. 🙂

Bruce

They are different. And there will be a change in MSE soon. They are into a Version 4 beta now. Another brief description is here . Neither description says the interface looks any different from the current MSE 2 interface. And both descriptions are short on details. But they say exactly what Microsoft says about Windows Defender for Windows 8 — that there are unspecified “enhancements” to the security engine.

Without specific details coming from Microsoft, it is impossible to evaluate these statements about “enhancements”.

-- rc primak

Reply | Quote

And there will be a change in MSE soon. They are into a Version 4 beta now. Another brief description is here . Neither description says the interface looks any different from the current MSE 2 interface. And both descriptions are short on details.

Yes, I’ve been using MSE 4.0 for four months. There are very few interface changes. Four alert levels added under default actions and Microsoft Spynet being renamed to Microsoft Active Protection Service are the only visible changes I can spot (ignoring a slightly different color background). There may be performance improvements, but in practice it’s very similar (as I haven’t deliberately loaded my PC with viruses to test it like the author of this article): Microsoft Security Essentials 4 Review

But they say exactly what Microsoft says about Windows Defender for Windows 8 — that there are unspecified “enhancements” to the security engine.

Without specific details coming from Microsoft, it is impossible to evaluate these statements about “enhancements”.

Fairly similar then?

Bruce

Reply | Quote

Yes, I’ve been using MSE 4.0 for four months. There are very few interface changes. Four alert levels added under default actions and Microsoft Spynet being renamed to Microsoft Active Protection Service are the only visible changes I can spot (ignoring a slightly different color background). There may be performance improvements, but in practice it’s very similar (as I haven’t deliberately loaded my PC with viruses to test it like the author of this article): Microsoft Security Essentials 4 Review

Fairly similar then?

Bruce

I wasn’t in time for the Beta of MSE 4. And I don’t expect radical changes there. MSE is a good product, and what you describe looks like a modest improvement, which is all I think MSE 2 has needed. I would be interested in finding out whether the system performance issues will clear up with Version 4 for those of us who have experienced these issues.

Let me make a series of observations about MSE 2 vs. Windows Defender in my own experiments under Windows 8.

I installed MSE into Win 8 DP, and this replaced Windows Defender. Very soon, performance issues showed up, like slower loading of the Legacy Desktop, less responsive programs and general sluggishness, as if MSE were running as a Legacy Mode App. Updating was slower than Windows Defender, and scans took longer (but not by much).

So I removed MSE and reverted to Windows Defender. Updating Defender was faster. System Performance as described above got back to normal for Windows 8 and most programs. Startups got at least a bit faster.

As always, your mileage may vary.

In file scanning, the engine for that function may well be identical to that of MSE 2, as are the definitions. But when scanning, Windows Defender does not show the items being scanned. This may make for faster complete file system scans. And I think there may be some differences in user preferences and settings controls.

I like to see at least which partitions are being scanned, but I already run a desktop gadget called Drives Monitor which I got from the author’s web site. With this gadget, I can see graphically exactly what activity is occurring on which partitions of which drives. That takes care of the Windows Defender Interface not showing what is currently being scanned. The Defender Progress Bar is reasonably accurate, but does not give the details which I prefer to see.

I find that Defender under Windows 8 has better integration, better performance, and a smaller resource footprint than MSE 2 under Windows 8. Apples to apples, the two are behaving differently. The quality of protection I believe is completely the same, although Defender may add a thing or two which MSE may lack.

MSE and Defender are both good security programs, and it looks like both are getting better. For Windows 7 and earlier, MSE works well. For Windows 8, Defender is very good from what I can tell.

And I am glad to see from your description that MSE 4 will not remove user controls the way Secunia PSI did with PSI 3 vs. PSI 2.

-- rc primak

Reply | Quote

The engine, definitions and interface are identical. I can only see that boot time may be quicker. What are the other improvements?

Bruce

According to the page referenced in DETAILS in my previous post, here are some improvements in Windows Defender for Windows 8:

“ Improved protection for all types of malware “. (Reread this section in its entirety.) Highlights include:

UEFI Safe Boot integration, dramatically less impacts on system performance (which I have personally seen), leveraging the other Windows 8 kernel-level, heap, ASLR and Smart Screen security improvements.

The engine is not quite the same as MSE, as stated in the article. The look and feel of the user interface are what the article says are similar if not identical. And in this I concur.

Just an anecdote, but I have noticed that Windows Defender does alert me from time to time if something tries to modify my IE or Chrome browser, like a Toolbar or a Tracking Cookie. More so than MSE. Scans also sometimes come up with more potential Trojan Horses, although I am careful enough online that these are relatively infrequent occurrances in any of my OSes. So something is definitely different here.

There are also Windows Firewall improvements in Windows 8, but that’s a topic for a different thread.

-- rc primak

Reply | Quote

I reckon the parameters measured are alright in and of themselves but there is a distinct lack of discussion on effectiveness, implementation methodology, philosophical intentions for such a wide range of RAM usage, and measuring an aspect of resource usage only by startup and shutdown times which, unless folks are rebooting every 5 minutes, is significantly less important than monitoring and scanning resource usage.

I’m a big proponent of host (native) virtualization anyway…it’ll be a good thing when we can drag all these stone age a-v programs into modernity.

Reply | Quote

I reckon the parameters measured are alright in and of themselves but there is a distinct lack of discussion on effectiveness, implementation methodology, philosophical intentions for such a wide range of RAM usage, and measuring an aspect of resource usage only by startup and shutdown times which, unless folks are rebooting every 5 minutes, is significantly less important than monitoring and scanning resource usage.

I’m a big proponent of host (native) virtualization anyway…it’ll be a good thing when we can drag all these stone age a-v programs into modernity.

You might like the approach of Immunet (also based on ClamAV) or Panda Cloud, which are in the cloud antivirus programs. I am test-driving these programs on my Windows 7/ Windows 8 dual-booting laptop. The worst aspect of Cloud AV is that if it is needed for an emergency scan, an Internet Connection may be impossible to obtain. Then the opposite philosophy would prevail — a completely independent stand-alone scanner like Microsoft System Sweeper (Windows Defender Offline, or WDO, or whatever they are calling it this week) or AV on a USB stick like Super Antispyware or Malwarebytes portable AV programs. The right tool for the right situation is very important to have. And virtualization is only one part of the equation.

-- rc primak

Reply | Quote

I am not too concerned about start up and shut down times as one can always pour a coke or light a cigarette.
And even memory and cpu usage are not my biggest concerns.
What is most noticeable to me are the delays in starting up Thunderbird and web sites in FF
They are REALLY noticeable delays.
Those delays would be ‘Elvis shoot the monitor’ incidents, if I did not notice the spinning AVAST icon.

A comparison on that aspect would be important to me.
(You don’t want me lighting up too often)

Rob

Reply | Quote

Keep in mind what the point of the article was; people out there have come to believe that MSE is a system hog. This article was meant to analyze that and compare that issue for MSE to some other free AV products. It made a clear point that MSE is not a hog in real life. And I added the point that I saw reasons why MSE could look at times like a hog when it really isn’t.

This was not an article about the effectiveness of the tools, though that did get mentioned. Instead, it debunked the incorrect impression that some users have had.

FWIW, I use this on a 10 year old system with minimal hassle. When I used NIS, it would work OK for a while, maybe several weeks, then it would bring the system down to a crawl. I’d have to completely uninstall NIS and then reinstall it to get normal operation again. The only such issue I’ve had with MSE is a false ‘your system may be at risk’ indication that has apparently been fixed. MSE has never impacted a system of mine badly enough to make me want it off.

Reply | Quote

I saw a similar comparison test a couple of years ago.

Then and also now there is one feature I dislike – manual pause of the stop-watch.

You commence the PAUSE too late – after you recognize the need to login.
You then go to the keyboard and after some delay you eventually login.

During this manual variable delay the CPU and HDD are NOT frozen – they continue to organize whatever they can.
The longer you take with the stopwatch paused, the less the CPU and HDD work that will remain outstanding,
and the more resources are instantly available for the post-login phase.

I consider it essential that comparison tests should NOT involve variable random delays from fallible human reactions,
so I ALWAYS avoid them.
On XP Home I simply cancelled my password for the duration of any such testing.
I assume this works on other computer systems.

Incidentally, I consider Shutdown time irrelevant because it never matters.
When I invoke shutdown I can immediately get on with my life,
so long as the computer is ready for me to remove all power and turn of the lights by the time I have my shoes and coat on.

Startup time is infinitely more important – I switch it on and it has to be ready to obey me by the time I have made a cup of coffee.

Reply | Quote

As a free tool MSE is certainly very good and I used it on several computers for a while. But in real live use, interacting with it’s own MS Office / Outlook, web browsing, it’s a dog, and a slow one, sorry to say. And the detection rates, in my own tests, are simply not good enough in today’s extremely virulent environment.

In my experience the free AV with the best protection vectors covered is Avast, but in performance it is only a little faster than MSE, although it’s protection is massively greater, and that’s more important than speed. I have it currently installed on one netbook out of 6 PCs at home. I have probably tested all the free AVs out there in the past 2 years, as well as many paid ones.

On 3 of the remaining 5 PCs they are protected excellently, and with no significant resource impact with Kaspersky IS 2012, and which for less than $10 per PC per annum via Amazon is an incredibly low price coupled with the best protection (in my tests and numerous reviews).

The question has to be, is it worth the risks and resource impact in trying to avoid just $10 ? I know my answer to that question.

Reply | Quote

I find your Avira time questionable. As one who is using Avira on a Physical Win7 Sp1 64bit machine and has it set to Priority mode (launches before anything else). I can’t say my machine has EVER taken anywhere near a min and thirty seconds or even thirty seconds to boot up. Perhaps Avira simply has a problem with virtual environments. Also you make no mention about the Quality of the scanners that are tested.

Just my two cents.

I use http://www.av-comparatives.org, http://www.antivirusware.com, among others for information on quality and resource utilization.

Reply | Quote

Fred, I admire and thank you for this comparison!

I venture to claim that I have extensive experience with MSE in real world scenarios. I started testing it in July 2009. Since August 2009 I install it on ALL my customer’s machines. Microsoft finally officially released MSE on Sept. 29th 2009 with no fanfare and no advertising.

You can read my early evaluations here and my most recent article mentioning MSE here.

Here is a quote from the first article:[INDENT]If Microsoft’s MSE keeps its quality promise and manages to slowly either push Norton, McAfee, Trend Micro and others out of business or force them to substantially improve and get cheaper at the same time than Microsoft would have done the public a huge favor. I never believed I would say that!

[/INDENT]

I believe that MS has done an excellent job with MSE.

These experiences and conclusions are derived from over 30 months of usage by a NON Microsoft fan boy on close to 1,000 different end user systems from XP to Win7.

@satrow:
You write: [INDENT]… MSE is hogging the bandwidth with massive updates.
‘Part-time’ users/2nd computers: some machines that are only used for a few hours several times each week often do NOT receive regular updates.
[/INDENT]

How did you determine that the bandwidth hogging was done by MSE?

Your “Part time” users would be well advised to do a manual check and eventual install for Windows Updates anyway BEFORE they even go into their email. That has absolutely NOTHING to do with MSE.

Don’t you know that Automatic Updates is usually only ca. 75% dependable? I urge my customers to check for updates manually once every week – at least. And they do very well with it!

Yes, MSE updates only when the computer is idle, that is when the user is not working and has no programs running that access the web or the like.

Reply | Quote

@satrow:
You write: [INDENT]… MSE is hogging the bandwidth with massive updates.
‘Part-time’ users/2nd computers: some machines that are only used for a few hours several times each week often do NOT receive regular updates.
[/INDENT]

How did you determine that the bandwidth hogging was done by MSE?

Your “Part time” users would be well advised to do a manual check and eventual install for Windows Updates anyway BEFORE they even go into their email. That has absolutely NOTHING to do with MSE.

Don’t you know that Automatic Updates is usually only ca. 75% dependable? I urge my customers to check for updates manually once every week – at least. And they do very well with it!

Yes, MSE updates only when the computer is idle, that is when the user is not working and has no programs running that access the web or the like.

Mobile users – many mobile users do NOT want their OS to become unusable for the first 10-15 minutes when they attempt to connect to base, check emails on the move from Starbucks or McDonalds because MSE is hogging the bandwidth with massive updates.
‘Part-time’ users/2nd computers: some machines that are only used for a few hours several times each week often do NOT receive regular updates.

It’s been pretty well documented and complained about by ‘road warrior’ types that MSE can be a complete hog on startup – Ctrl+Shift+Esc or a right-click on the taskbar quickly shows the responsible task to anyone familiar with using a Windows machine for daily use.

Part-time user: Grandma takes a phone call that says, “Hey, don’t you ever check your email, I sent you some pictures of your grandson’s first school play 3 days ago”, Grandma rushes to start the computer, waits 15-20 minutes before she gets to see the ‘photo’s, she then complains about her PC being slow – some people buy and use computers so they can communicate with friends and family more easily, NOT to spend more time waiting for updates to happen and going to night school just so they can learn to service their PC before checking email or 2 Facebook pages.

I’ve seen machines that I know had been used for several hours on at least 2 days each week for the previous 3 weeks, yet the last time MSE had updated or scanned was 4+ weeks previously. How much electricity do you expect people to burn, on the off-chance that MSE might just update or scan if the PC is left alone for a few hours, overnight?

How did you determine that the bandwidth hogging was done by MSE?

It usually takes me until about 15 minutes into the visit, around 3 minutes after I press the On button; for the exact method, see above.

Don’t you know that Automatic Updates is usually only ca. 75% dependable?

MSE is supposed to be simple and automatic to most people means they don’t have to do anything themselves.

Some of these things really make you wish Macs were more affordable.

Reply | Quote

Fred, I admire and thank you for this comparison!

I venture to claim that I have extensive experience with MSE in real world scenarios. I started testing it in July 2009. Since August 2009 I install it on ALL my customer’s machines. Microsoft finally officially released MSE on Sept. 29th 2009 with no fanfare and no advertising.

You can read my early evaluations here and my most recent article mentioning MSE here.

Here is a quote from the first article:[INDENT]If Microsoft’s MSE keeps its quality promise and manages to slowly either push Norton, McAfee, Trend Micro and others out of business or force them to substantially improve and get cheaper at the same time than Microsoft would have done the public a huge favor. I never believed I would say that!

[/INDENT]

I believe that MS has done an excellent job with MSE.

These experiences and conclusions are derived from over 30 months of usage by a NON Microsoft fan boy on close to 1,000 different end user systems from XP to Win7.

@satrow:
You write: [INDENT]… MSE is hogging the bandwidth with massive updates.
‘Part-time’ users/2nd computers: some machines that are only used for a few hours several times each week often do NOT receive regular updates.
[/INDENT]

How did you determine that the bandwidth hogging was done by MSE?

Your “Part time” users would be well advised to do a manual check and eventual install for Windows Updates anyway BEFORE they even go into their email. That has absolutely NOTHING to do with MSE.

Don’t you know that Automatic Updates is usually only ca. 75% dependable? I urge my customers to check for updates manually once every week – at least. And they do very well with it!

Yes, MSE updates only when the computer is idle, that is when the user is not working and has no programs running that access the web or the like.

Sounds like you and I have come down the same track and reach the same conclusions. As a 30+ year tech I put this piece of software at the top of the list to install on any PC.

Reply | Quote

Sounds like you and I have come down the same track and reach the same conclusions.

@DrPC
Thanks, sure looks like we might be birds of similar feathers.

I bet that all those guys with “MSE slowed my old XP machine” never even thought of making certain that the machine was clean BEFORE they installed MSE.

And they likely never did use AutoRuns to remove the leftover drivers and/or processes after uninstalling Norton, McAfee or other “for pay” AV stuff.

LMAORO all the time when I read all this grumbling.

Have a nice day.

Reply | Quote

With MSE running on a variety of desktop and notebook systems – single and dual core, XP, Vista (just so I can have something to complain about) and Win7, I can safely say that MSE is the most efficient of all the free AVs I’ve tried. It’s also the most efficient compared to all the trial/paid versions of McAfee, NAV and several other fee-based AV products I’ve tried. AVG was real good a few years ago, but it’s gotten so bloated and stodgy that I had to abandon it.

That said, MSE has missed a couple of nasties I could have done without – I hope they can improve detection accuracy a bit. As far as the $10 vs. free comparison, I try to run what I imagine most of the people who have me work on their systems would want, and they almost invariably prefer the free stuff – not so much because it’s free but because they don’t have to fuss with renewals, online transactions, etc. to keep it running consistently. (Most of my “customers” are dinosaurs. :-0)

All in all, it beats the other freebies I’ve tried and with rare exception, you can’t beat the price.

Reply | Quote

As a computer tech, I’ve been installing MSE on all types of systems with very few problems

One thing to note is that Clamwin is the only AV I have found that still works with Windows 98 !!! Yes, I still have customers using that!

AC

Reply | Quote

A couple of other notes.

I used to install AVG, but around version 8.5 or 9 I noted WinXP machines slowing down. Looking at the processes, I noticed that AVG had shifted a lot of the load to SYSTEM process, increasing the allocated memory from around 4 Mb to 128 MB!

Also, as AVG notes (I believe) only 3% of the online dangers we face today are viruses. You need to have a suite of protection, whether from one company or made up of different programs. How your AV protection interacts with antispyware could dramatically shift results.

AC

Reply | Quote

A couple of other notes.

I used to install AVG, but around version 8.5 or 9 I noted WinXP machines slowing down. Looking at the processes, I noticed that AVG had shifted a lot of the load to SYSTEM process, increasing the allocated memory from around 4 Mb to 128 MB!

Also, as AVG notes (I believe) only 3% of the online dangers we face today are viruses. You need to have a suite of protection, whether from one company or made up of different programs. How your AV protection interacts with antispyware could dramatically shift results.

AC

This matches my experiences with AVG. Modern AV products are suites. There’s really no distinction between AV and AS anymore.

-- rc primak

Reply | Quote

I use Avast on one machine, and MSE on the other. The MSE machine boots significantly faster, and works more smoothly except for the fact that it nags you more often, whining that it needs to be scanned and/or updated, but overall performance is DRAMATICALLY better with MSE. Thanks for the good info, and keep it coming…

Reply | Quote

We’ve used the free version of Avira for the past half-dozen years or more on systems ranging from Win2K through Vista due to its excellent detection rates (the main knock reviewers give it is for its nag screen, which can easily be suppressed). Its use of resources is minimal both during start-up (where it adds only a second or so) and during normal operation (where Task Manager confirms that while its peaks can be high its typical memory usage is in the 15 MB range, and its scanning rates are speedy).

When we got our first Win7 system (a Netbook) I therefore ripped out MSE, Norton, and other bloatware friends and substituted Online Armor and AntiVir – and start-up times went to pot. I can’t swear that this didn’t happen on our sole Vista system (since it’s my daughter’s and it’s been hands-off for me since I set it up), but it certainly hasn’t elsewhere.

Bottom line: MSE seems to work pretty well on the Netbook and our other Win7 systems (where I haven’t experimented again with AntiVir, though may if I can find the time to), but we’ll be sticking with AntiVir elsewhere (unless my daughter let’s me check out her laptop and I find it’s sluggish there).

Reply | Quote

We’ve used the free version of Avira for the past half-dozen years or more on systems ranging from Win2K through Vista due to its excellent detection rates (the main knock reviewers give it is for its nag screen, which can easily be suppressed). Its use of resources is minimal both during start-up (where it adds only a second or so) and during normal operation (where Task Manager confirms that while its peaks can be high its typical memory usage is in the 15 MB range, and its scanning rates are speedy).

When we got our first Win7 system (a Netbook) I therefore ripped out MSE, Norton, and other bloatware friends and substituted Online Armor and AntiVir – and start-up times went to pot.

Odd. I’ve also used Avira for several years. I’ve recently installed it on several Windows 7 machines and have not noticed any impact on start-up times.

Reply | Quote

Odd. I’ve also used Avira for several years. I’ve recently installed it on several Windows 7 machines and have not noticed any impact on start-up times.

First of all I would like to know what “bill” meant with “times went to pot”. Do I need to apologize for not being a native English speaker? I simply don’t know that slang expression and it’s meaning.

Owen, your I respect your experiences. IMHO the risk enters the picture when we start to project a few experiences as a “general rule”.

I have many experiences totally to the contrary but it does not do anybody any good to go into the endless “My Experience versus Your Experience” debate.

I claim that MSE “blocking” a computer on startup is due to the fact that the machine was not squeaky clean from malware (rootkits!) when MSE was installed. I have seen it happen way too often to assume anything else.

We should never assume that a machine is clean just because any security suite or AV has been running.

Reply | Quote

First of all I would like to know what “bill” meant with “times went to pot”.

Deteriorated.

Bruce

Reply | Quote

I claim that MSE “blocking” a computer on startup is due to the fact that the machine was not squeaky clean from malware (rootkits!) when MSE was installed. I have seen it happen way too often to assume anything else.

We should never assume that a machine is clean just because any security suite or AV has been running.

That may often be the case but I’ve seen several occurrences when it wasn’t; see also #108 for a recent comment on that in this thread.

Reply | Quote

This was a great analysis for Windows 7, however, with XP I have seen a lot of “99%” usage with MSE starting between 1 minute and 5 minutes AFTER you log into the system. It comes up fine, but then for about 5 minutes the process takes all the CPU and you can’t do much of anything on the system. This has been seen on several different systems (One laptop and several desktops). Performance is worse on systems with less RAM as might be expected, but even on a 2 GigByte XP system it slows down.

Note1: MSE settings are to not use more than 50% of CPU during scan, but this is not during a scan, it is after a reboot.

Note2: If MSE has not been updated for a while this may not start until 5-10 minutes after update, timing is not consistent.

Note3: I still use MSE on several systems, it seems to work well once it gets past a few minutes of hogging the CPU.

The attached task manager picture is from a P4-2.8GHz upgraded with 2 gig RAM and shows the engine consuming CPU resources. (MS isn’t the only one with problems like this, Secunda’s psia.exe does the same on occasion, but doesn’t appear to do it on every reboot).

30097-MsMpEng.exe_

Reply | Quote

Fred,
Blindly installing 5 or 6 AV’s with default values but, not knowing what is running @ start-up does easily impress the less experienced user as is apparent by all of the “good test Fred, just what I…” comments. For the rest of us this is seemingly not up to the usual standards found in articles @ WS. I do hope you include this routine in your act when you appear at one of the local clubs. (could you please furnish the dates and times for your LA area appearances¿)

thanks-a-bunch,
michael clyde

Reply | Quote

I fix a lot of virus infected computers and it is MSE the computer leaves with. I find the product works best if you select Delete for all actions in the settings. The scan settings must be changed to a full scan as well.

Reply | Quote

To begin with, there is a serious misunderstanding regarding just what a “resource” is when talking about computer system performance. There are only four resources can cause a bottleneck and affect performance.

CPU Utilization: Generally, your comparison did not compare this parameter except perhaps in boot time but probably not even there since most of boot time is taken up with disk IO delays. You could have beneficially run the various systems through a set of routines that would have exercised the packages in their various functions and then looked at the CPU used by the program’s processes as captured by Task Manager. You could even have left the systems go idle for ten minutes or more to see the effects of the launch of an ‘idle time scan’ and it’s interruption should such a feature exist. These types of numbers are far more indicative of a package being a CPU pig.

Memory Utilization: Again, the memory used during actual operation (as opposed to used immediately after boot) would have been a much more indicative of a package’s impact on performance and, again, such information is readily available in Task Manager.

IO bottlenecks: While there can be IO bottlenecks in other areas, such as Networks or Displays, we are generally concerned with disk IO reads and writes when considering a AV package. Again, the accumulated IOs associated with the processes belonging to a package are easily available in accumulated form in Task Manager.

Locks and Latches: This last item is most often associated with multi-user systems and databases so it is not likely a concern here.

Given that you missed most of these items and really only considered memory utilization in a very cursory and incorrect way, I have to say you missed the mark. Boot time and shutdown only occurs about once per day. Nobody cares what the footprint is on disk unless it is taking up the last of the free space. At the current cost of about $50 per TB, disk space is not costly. Approximately the same can be said of memory.

Perhaps more important, is the flaw in comparing the various free AV programs with MSE. The free AV programs are generally just an anti-virus utility and not even very good at that in some cases. Failure to test email for viruses would seem to me to be a serious flaw in any AV program as would an AV utility that did not operate in real time or only operated on user demand. No system could be considered ‘secure’ just because it has any of these packages running except those with MSE. All the others have serious failings as a security package and it would be very incorrect to suggest to a typical user that they are adequate security protection. Even the producers recognize this and use these ‘free’ AV utilities as a loss leader to entice the user into purchasing their more comprehensive package which is not free. Except MSE, of course. It bills itself as a security package and it comes far closer to that description than do any of your comparison packages.

A knowledgeable IT person may be able to collect a free AV utility along with a free firewall and several other free utilities that would collectively be considered a ‘security collection’ but the configuration, operation and administration of the collection is far beyond the typical user. MSE is the only package that is both free and something like comprehensive. It may not be the best security suite but it is free and at least capable enough to be considered acceptable. Personally, I prefer to lay out $15 for each of my three systems and put Norton 360 on each rather than spend my life managing these systems.

Reply | Quote

I have noticed that MSE runs nicely with Vista and 7 but has problems with XP. On XP I install Avira or AVG.

Reply | Quote

I got rid of MSE after trying it when it first came out because I noticed that it took a very long time to be able to access files on a USB flash drive with MSE installed. It took seven times longer than with Avast installed in fact. This is a test that was not done in this article. I would like to know if the latest version of MSE is any better in this regard before even thinking of going back to it. Just try running an antivirus scan on a nearly full 8 GB USB drive with each program and report the scan time results.

Reply | Quote

Wow! This was not a full fledged scientific study. It was a quick test to see if the myth held up. It didn’t. Why are some readers making such a big deal over it?

Reply | Quote

Long experience with all these AV products (ClamWin excepted) has shown me the value of using MORE THAN ONE of them in a networked environment. When cleaning-up infected syatems, I have learned that they do not all consistently detect the same threats.

It’s worth noting that in my real-world (but unscientific) experience, Avira has been the most effective for use in cleanup of multiply-infected syatems. It finds more of the malware, more consistently. But it can still miss things that another scanner may find.

On one small-business network I manage, I have the free AVG, Avira and MSE running on separate workstations. Avira is indeed a resource consumer, but it lives on the most powerful of their machines and so its comparative effect on performance has been negligible.

Where server-based files and applications are shared among these workstations, I believe the multiple apps run a better chance of spotting any malware that may creep in.

It’s worth noting that on that particular network we’ve had near-zero malware problems in recent years (a few minor/failed threats spotted in browser caches), so the concept hasn’t been put to any harsh tests in that setting. There have been two instances of false positives. Avira was the guilty party both times.

Reply | Quote

To measure statups and shutdowns is nice, however, the real meat and potatoes is the effect an AV progams has when the computer is in full use. I would have liked to have seen a comparison of the times measured to perform various exactly duplicated heavy usage tasks such as downloads, video conversion, number crunching spreadsheets, or running a benchmark, without and with a simultaneous backgrond scan. For example, a conversion of a video from .mpg to .avi takes 22 min with no background scan, 37 min with MSI background scan, and 44 min with Avast backgound scan would have been very informative. How about opening the same downloaded file and measure the time from start to display as the file is scanned when opened assuming all are in real time scanning mode. This would have been much more indicative the impact an AV program has. As for this experiment, it was only superficial.

Reply | Quote

Please redo this test with older XP single core machines! I think you will be surprised, MSE seems to slow them down considerably. MSE win7pro w/8gb ram great! MSE xp sp3 w/ 1gb ram not so great. I would very much like to see a current comparison using older machines and new AV software.

Reply | Quote

My personal experience: no issues on older XP single core machine – AMD Sempron 3400+ @ 1.8 GHz, 4 GB ram (only hardware upgrade since purchase), 80 gb HD, XP SP3. Installed MSSE over two years ago to replace commercial software that was giving me headaches. Quicker cold-start boot time (it’s an old machine, nothing is truly quick anymore), fewer system hangs, more resources available. If MSSE is affecting start time, it is not in addition to the other known software drags. No problems during virus definition updates, and system scans are relatively quick without hangs or stoppages.
Same on laptop. AMD dual core, 4gb ram, 500 gb hd. MSE installed two weeks after purchase, to replace the Macafee Trial edition it came with. A small improvement on boot time, no system hangs or resource issues. Nearly two years with no issues attributal to MSSE.
I was very reluctant to try MSSE, as my experiences over the years make me a careful (= paranoid) and conservative Microsoft user, very slow to adopt anything new out of Redmond. For me, it has been a very pleasant surprise, especially on the single core machine.

Reply | Quote

Interesting article. I tried the exact same experiment with McAfee, probably one of the most complete AV on the market and my results were:
Startup Time: 65 seconds
Shutdown Time: 13 seconds
The amount of disk space and memory such a program uses is almost without meaning when there is so much of both on any modern computer. My up and down times were quite good for such a large program.

Reply | Quote

Fred, one thing you did not address was CPU usage. I find in single core machines MSE often spikes the CPU up to 60+% and often stays there almost like it is hung. Restarting the service fixes the problem. It seems there is some issue with the realtime scanning of files that causes the service to get stuck. On my machines I have used Process Lasso to look for the condition and restart the service when it happens. However it would be nice if there was a fix from Microsoft but then what do you expect for free? I expect it to work without issues but then that is what I have gotten used to with Avast. Every antivirus seems to have some issues; some more than others. It just seems to me we need to look at all issues. I see you used a virtual machine; can you provide a little more detail about the setup of the machine? I have not seen the issue on dual core machines or above so I am thinking it is an issue with older hardware. Thanks.

Leland

Reply | Quote

Thanks a lot Fred. I’m using four PCs with Windows 7 Home Premium SP1 64bit, all with MSE and NO other AV program. No complaints. Auto-updating works well. The genesis of MSE was in Giant Software – purchased by Microsoft. It helps when you buy the best.

Reply | Quote

I got rid of AVG free because it grew to be a bloated dog that took up around around 500MB and it extended boot times by up to 4 minutes! So I switched to MSE based on FL’s recommendations.

“The immediate conclusion — at least in these controlled-environment tests — is that MSE is not the “resource pig” some PC users think it is. In fact, it offers respectable, near-best numbers in every category. Whatever was going on with Bill’s system is not likely to be intrinsic to MSE.”

But I have to disagree with Fred here and agree with Bill. I am also running WinXP (but on older but high-end hardware) using an Intel E6750 dual processor CPU that has been overclocked 20%. MSE doesn’t use excess resources AFTER it has initialized itself or AFTER it has completed downloading and updating itself.

However, whenever I reboot, MSE takes nearly 90 seconds to initialize itself . I have sat and watched the CPU peg 100% in the Task Manager graph while it gets itself going and everything else has to sit and wait. Very annoying.

And then when MSE downloads updates, it also sucks up CPU cycles. I mostly solved this problem by permanently assigning MSE to only run on the 2nd CPU core and lowering the priority to “below normal” through a task management program that I run all the time.

Rerun your tests Fred and this time, focus on boot initialization and program/signature updating on WinXP SP3.

Reply | Quote

I was really laughing when the letter writer said he wouldn’t use MSSE because it added 30 seconds to boot. When it takes three minutes to boot the machine, whats 30 seconds more?? I support elementary school computers and I’m shocked at the deplorable state. I finagle computers from the county when their offices get new PCs. They replace theirs every three years, which is a brand new computer in my world. Try running XP on a machine with 512MB and see the time it takes to launch Word 2003. No one in the country is talking about the electronic dogs in classrooms all across this country. I am 3/4 time and am the sole support of seven elementary schools. We are in trouble out there, Mr 30 Seconds.

Reply | Quote

I have used MSE successfully on many Win7 and XP installs. I have had a few XP installs with problems, probably because I did not follow my own guidelines.

MSE CANNOT be installed successfully on a computer that have EVER had other AV, virus scanners, firewalls, real time scanners, samples, etc. installed WITHOUT A COMPLETE UNINSTALL and removal of all previous installs. This includes uninstalling Windows Defender from XP computers (cannot be uninstalled from Win7, but MSE will disable WD on Win7). Running the normal uninstalls may not actually completely uninstall the AV programs correctly and require using the removal tools from the AV publisher.

Follow these instructions to completely remove the AV type programs — http://answers.microsoft.com/en-us/protect/forum/protect_start/list-of-anti-malware-program-cleanupuninstall/407bf6da-c05d-4546-8788-0aa4c25a1f91
Use this checklist to understand what is required to prepare for MSE — http://answers.microsoft.com/en-us/protect/forum/protect_start/check-list-for-installing-microsoft-security/bf757e6a-e320-4a67-92bc-767e6acb26c4
Answer to MSE questions — http://answers.microsoft.com/en-us/protect/forum/protect_start/windows-defender-and-microsoft-security-essentials/5309cb8d-02e1-40e8-974f-0dcedb9ab9fd

Reply | Quote

Many people get all confused about RAM usage of AV as well as other software. On a modern / Win 7 system the OS and programs will often adjust according to the amount of RAM available, so the more you have the more it will swallow, but then it makes response times faster because it’s in RAM not disk! That’s the whole point in having more RAM, to actually use it not having a vast space empty.

Anyway, back to MSE, I have noticed that it, and several other AVs pump up svchost.exe, and there can be many svchost.exe entries. So just totalling the obvious MSE processes is a massively false illusion, and really a waste of time comparing 12mb with 20mb, or whatever, it’s peanuts, and most of it is hidden, and at the end of the day Win 7 will manage your memory very well.

Reply | Quote

I have just gone full MSE on my own computers. I actually replaced a paid app (for which I have a site license) for MSE, since I was getting fed up of a splash screen taking minutes to go away until the app interface would show up. My laptop feels a lot “lighter” now.

Reply | Quote

I looked at the data and comments in reference to MSE and other AV programs. One thing that isn’t really mentioned but can really be an aggravation at times is that some of the AV programs, including AVG, will delay opening document files such as .doc, .docx, .xls etc while the program “scans” the file before opening it. I am all for making sure that things aren’t on my system, but when its a Word document that I am writing on my local drive that isn’t and most likely never was downloaded, I hate waiting for some varied amount of time, while the AV program scans the document for viruses.
If you have a fairly long document as I have at times when writing operation manuals that can be very, very log, it can take 30 seconds or even longer (I actually had one doc file that was the master manual and was over 300 pages long and it would take at times, depending on other things running on that system, nearly 1 minute to open the file because it needed to scan that local drive file).
Again, I am all for making sure that a downloaded file is virus free, but if the document is a local drive created document, spreadsheet etc, it can be a real “finger-drumming” issue when you have a fast computer that is waiting for document scanning.

I’m Just Saying……………………. LOL
William Sheets

Reply | Quote

I looked at the data and comments in reference to MSE and other AV programs. One thing that isn’t really mentioned but can really be an aggravation at times is that some of the AV programs, including AVG, will delay opening document files such as .doc, .docx, .xls etc while the program “scans” the file before opening it. I am all for making sure that things aren’t on my system, but when its a Word document that I am writing on my local drive that isn’t and most likely never was downloaded, I hate waiting for some varied amount of time, while the AV program scans the document for viruses.
If you have a fairly long document as I have at times when writing operation manuals that can be very, very log, it can take 30 seconds or even longer (I actually had one doc file that was the master manual and was over 300 pages long and it would take at times, depending on other things running on that system, nearly 1 minute to open the file because it needed to scan that local drive file).
Again, I am all for making sure that a downloaded file is virus free, but if the document is a local drive created document, spreadsheet etc, it can be a real “finger-drumming” issue when you have a fast computer that is waiting for document scanning.

I’m Just Saying……………………. LOL
William Sheets

That Scan on Access behavior can usually be shut down for known safe file types, or completely switched off. How to do so varies by product and vendor.

-- rc primak

Reply | Quote

That Scan on Access behavior can usually be shut down for known safe file types, or completely switched off. How to do so varies by product and vendor.

Which are the known safe file types?

Is switching off on-access scanning a sensible suggestion?

Clamwin was criticised earlier in this thread because, unlike the others tested, it didn’t include any on-access scanner.

Don’t we have to decide whether we want AV software to block viruses, or merely to attempt damage repair after the event? I think I’d opt for blocking every time.

Bruce

Reply | Quote

Which are the known safe file types?

Is switching off on-access scanning a sensible suggestion?

Clamwin was criticised earlier in this thread because, unlike the others tested, it didn’t include any on-access scanner.

Don’t we have to decide whether we want AV software to block viruses, or merely to attempt damage repair after the event? I think I’d opt for blocking every time.

Bruce

It isn’t either all on or all off for Scan on Access in a well-configured AV program. There is a possibility that large or zipped files could become infected, or that the first time they are downloaded they may be infected, but the risks are not worth considering if scanning a big file or a unzipping a compressed file each time it is accessed slows a computer to a crawl for several minutes at a time, as was happening with Avast 5 on my Windows XP laptop before I made some exceptions to its Scan on Access settings. This was several Avast versions ago, so the exceptions options may no longer be there in the Avast free version. I apply exceptions with Comodo Defense Plus and most AV/AS scanners, to reduce slowdowns and stalls. In fact, such products as Super Antispyware by default skip file scans of large files and certain temp files. System Restore and WinSxS and WoW are other areas most AV/AS scanners skip by default. But these areas are never scanned on access. The Paging Files are another area where scanning on access would be impractical. If a file was created over a week ago, I would not want to have it scanned on the next access, provided it has not been modified in between then and now.

In general, Scan On Access has for me been more trouble than it is worth on all my laptops. I do not rely on this feature as a line of defense.

-- rc primak

Reply | Quote

If a file was created over a week ago, I would not want to have it scanned on the next access, provided it has not been modified in between then and now.

Is it possible to set a scan exclusion for files created and last modified over a week ago? In MSE (which I know you use), I can only configure specific folders, files or file types to be excluded.

Bruce

Reply | Quote

Is it possible to set a scan exclusion for files created and last modified over a week ago? In MSE (which I know you use), I can only configure specific folders, files or file types to be excluded.

By the time you read the file info for last access time and then checked some kind of table to see you last scanned the file, you would be introducing a LOT of overhead (which is what a lot of people complain about). It is much quicker just to scan or exclude by file type or folder name.

Reply | Quote

Is it possible to set a scan exclusion for files created and last modified over a week ago? In MSE (which I know you use), I can only configure specific folders, files or file types to be excluded.

Bruce

It varies by product. Some AV/AS has an option (Super Antispyware does this) to exclude any files not modified since a week, a month, or some other time ago. MSE is simplified, so it does not offer this option, last I checked. On systems with only a few areas of files which are frequently accessed, this exclusion can save a lot of time, by not rescanning unused large files or rarely run programs each time a scan is run.

-- rc primak

Reply | Quote

Some AV/AS has an option (Super Antispyware does this) to exclude any files not modified since a week, a month, or some other time ago.

Where’s that option in SUPERAntiSpyware? I only see Excluded Folders.

Bruce

Reply | Quote

MsMpEnt.exe does show up in the processes tab of Win 7, but the problem is it brings my XP machine to a halt for almost two minutes. I can’t load any program, e-mail, Internet, nothing until the CPU usage gets down to 20% to 25% usage. Granted, my XP machine is not the fastest, but MSE is the only antivirus program that stalls my startup. So it’s not a question of whether MsMpEng.exe is present, it is what it does to my XP system. It does not effect my Win 7 system at all.

Tom

Reply | Quote

Where’s that option in SUPERAntiSpyware? I only see Excluded Folders.

Bruce

When you begin a scan in SAS, choose the Complete Scan option. A screen pops up with the drives to be scanned on the left. On the right, there is an item “Modifed Files”. This is the place to specify that if files have not been recently modified, SAS should skip them.

AVAST by default automatically keeps a record of files which were scanned recently. If they have not been modified, they are not scanned. This makes the next scan faster, and can over time make scanning a lot faster on systems where some files are infrequently accessed.

-- rc primak

Reply | Quote

Here is a screenshot I took today (Monday morning) after a reboot. The first part is Task Manager maybe 2-3 minutes wall time into the Windows desktop init and you can see that MSE has already consumed 90 seconds of CPU TIME! In th 2nd part of the screenshot (Approximately 11 hrs later), the MSE app has accumulated 2:47 CPU time, almost double what it accumulated in the first few minutes of start-up. IN other words it took 11 hours to match what happened in the first 3 minutes or so.

While the MSE initialization is going on, MSE effectively locks out my dual core, overclocked system for 90 seconds or so while it monopolizes the CPU. This should not happen, IMO.

30146-MSE-Startup

Reply | Quote

@ ibe98765: Windows Update memory usage can also be added to that MSE total.

Reply | Quote

@ ibe98765: Windows Update memory usage can also be added to that MSE total.

I don’t understand what you are saying.

Reply | Quote

I don’t understand what you are saying.

Windows/Microsoft Update is part and parcel of the MSE update feature.

Reply | Quote

Windows/Microsoft Update is part and parcel of the MSE update feature.

I’m sorry, but I still don’t understand what you are attempting to say.

What I pointed out was MSE using 100% of the CPU during the first few minutes of WinXP initialization. Consuming CPU cycles to this degree has nothing to do with Windows Update.

Anyway, I don’t think that MSE is updating itself at Win init time. I believe it is hooking itself into the OS at this time.

btw: I have monitoring software running which shows me WHEN MSE does its updates, which seem to occur two and sometimes three times daily, at ever changing times. Notification of the update will pop-up and I can see it happen in real-time. Originally, these updates also slowed my system down (at least inside Firefox and in the use of the mouse) until I fenced MsMpEng to run only on processor two and at low priority. That fixed that problem!

Reply | Quote

The greatest mistake a system administrator can make is to assume that their configuration is “the best”, and that if there are performance problems, it must be the fault of some piece of software. There’s way too many combinations of software, hardware, network, etc. that can effect the performance of your system. WS in general, and Fred specifically is meticulous in his methodology for testing the effect of products on a running windows OS (and that has been proven over a number of years and different variations of windows). His recommendations are spot on. If it doesn’t work on your system, it’s probably something you have done to your system that is causing the problem. There is no vendor or lab that can test every combination of “stuff” and make it work efficiently on every system. People that whine about their experience just haven’t done enough homework to diagnose the problem. Thanks, Fred…

I’m sorry, but I still don’t understand what you are attempting to say.

What I pointed out was MSE using 100% of the CPU during the first few minutes of WinXP initialization. Consuming CPU cycles to this degree has nothing to do with Windows Update.

Anyway, I don’t think that MSE is updating itself at Win init time. I believe it is hooking itself into the OS at this time.

btw: I have monitoring software running which shows me WHEN MSE does its updates, which seem to occur two and sometimes three times daily, at ever changing times. Notification of the update will pop-up and I can see it happen in real-time. Originally, these updates also slowed my system down (at least inside Firefox and in the use of the mouse) until I fenced MsMpEng to run only on processor two and at low priority. That fixed that problem!

At startup and when logging into an account which is not involved in Fast-Switching, MSE Services (mostly its Antimalware Service) must restart and initialize. On single-core systems, this can cause significant system slowdowns in my experience.

My dual-core (core i5) Toshiba Satellite laptop handles this behavior just fine without “fencing”. (Core i5 does some of its own load-balancing internally.) It is Windows XP and single-core processors on older motherboard chipsets which can really run afoul of this MSE behavior. The behavior usually has nothing to do with updating of any kind.

The same stopping and restarting of MSE Services does occur after each definitions update on my laptops, and I do not know why this happens. My Comodo Defense Plus HIPS Firewall does not like MSE’s behaviors and slows things down even more. Not all of these conditions apply to all MSE users.

Other AV programs may also display this sort of behavior, but mostly when their Active Shields are running at the time of an update.

-- rc primak

Reply | Quote

Great job and test Fred. Keep up the good work. Have been useing MSE since day one.

Reply | Quote

It is present on my W7 system, in the antimalware folder of MSE.

Dick

Reply | Quote

You are right, it is part of MSE program, but what I’m saying is that it does not show under the “processes” tab in Task Manager. In WinXP it takes a horrible length of time to do whatever it’s doing taking up processor time.

Reply | Quote

It will show up in the processes tab in Win 7 if you click the “show processes from all users” button.

Jerry

Reply | Quote

[h=2]MsMpEng.exe in Win7 & XP[/h]

[INDENT]You are right, it is part of MSE program, but what I’m saying is that it does not show under the “processes” tab in Task Manager.[/INDENT]

It will show up in the processes tab in Win 7 if you click the “show processes from all users” button.

Jerry

Reply | Quote

In XP, its a function of processor speed and memory. I’ve fixed several XP machines with this problem by installing memory to bring the total to 1 gigabyte.

Jerry

Reply | Quote

Have not heard anything good on PC Doctor. Aren’t they the ones who advertise with the infomertial. I never trust those anyway.

Reply | Quote