Do most antivirus programs take advantage of multithreading?

[Ertaz]

I do some shade-tree virus removal for folks. Typical malwarebytes/AVG/spybot etc kind of stuff. I usually pop the drive out of the infected box, attach it to my spare PC and let the scan run. (I know, "Beware of programmers who carry screwdrivers."


It is uber slow on my 3200+. I want to speed this process up and I was wondering if anyone here had thoughts on doing this with a dual core box versus a quad core. The rig might do some light gaming for me once Diablo 3 comes out. Would the extra two cores be doing a lot for me?

Here are my rigs for doing this :

i7 930
6 gigs
x58 Mobo
@ $550

or

i3 530 or i7 860
4 gigs
p55 mobo
@ $330 or $430

 

[Zap]

I would think that at some point you would be limited by the speed of the hard drive.

Next time you scan an infected drive, monitor your CPU utilization. Also, watch the HDD activity light.

You would definately want to upgrade at some point because having a second core can be very useful in your everyday use of the system.

 

[alyarb]

very little processing is going on during a scan. it's like searching all your storage for a file, or in the case of a scan, a signature of any of thousands of possible infections. your old hard drive is probably the slowest thing in your computer, but zap is also right. there's nothing like going from one core to two cores. i wouldn't worry about upgrading it, just get a new machine when you are ready to start playing diablo 3.

 

[Ertaz]

I had a dual athlon xp box back in the day, and for its time it was a great machine. I am going to be running by Microcenter and it's hard not to plop down the cash for a 930.

 

[alkemyst]

I had a 3200+ to 4000+ to Opteron 165 to my current Phenom x3 720...

each time it was noticable, at the change to the 165 though was when I stopped really noticing if a virus scan was even running.

 

[Ertaz]

I've been out of the hardware game a while. I'm excited to see what the performance will be like on a new rig.

 

[Hacp]

You're probably limited by your crap hard drive. Get an SSD.

 

[tcsenter]

You're probably limited by your crap hard drive. Get an SSD.

That isn't going to do much for the hard drive (in an external enclosure) being scanned for viruses.

OP is seriously RAM limited @ only 512MB. Any decent antivirus/malware security applications are going to tip the scales at 150+ MB memory utilization during a scan. I would recommend adding 1 GB RAM before you spend the money on an entirely new machine.

 

[RussianSensation]

Go with the Core i5 750 system instead of either the Core i3 or the i7 860. 6GB of ram is a waste over 4GBs for the tasks you described. You also don't have to buy 6GBs of ram for the 930 system since X58 chipset with 2 sticks will be about the same as a P55 chipset.

As Hacp said, virus scanning is primarily hard drive limited so an SSD is the way to go.

Read this:
http://techgage.com/article/ocz_vertex_turbo_120gb/8

Another way to look at it, is if you get an SSD on the 3200+, and it doesn't improve things much, you can always build a new system around it. If it fixes the massive slowdowns, then you can wait longer to upgrade

 

[Dark Shroud]

Also AVG has a pretty low detection rate. MSE is better, Panada Cloud AV is good but not a great UI.

 

[Ertaz]

That isn't going to do much for the hard drive (in an external enclosure) being scanned for viruses.

OP is seriously RAM limited @ only 512MB. Any decent antivirus/malware security applications are going to tip the scales at 150+ MB memory utilization during a scan. I would recommend adding 1 GB RAM before you spend the money on an entirely new machine.

Whoops! I am running a gig now. My sig is seriously out of date. I have a SATA usb2 dock, but I have been know to connect the drive directly to the motherboard. I just want the most expedient scan I can get for a reasonable amount of $.

 

[Ertaz]

Also AVG has a pretty low detection rate. MSE is better, Panada Cloud AV is good but not a great UI.

Malwarebytes is my mainstay. Avg has been hanging around because I haven't really looked for anything else, but I will give security essentials a try.

 

[3DVagabond]

This says it's multithreading and it's free. Maybe give it a try?

http://www.download3k.com/Network-tools/Network-monitoring/Download-SoftPerfect-Network-Scanner.html

 

[zephyrprime]

I would think that at some point you would be limited by the speed of the hard drive.

This.

 

[Ertaz]

Hey I picked up a 930 today. Now to wait on the rest of the parts. I get paid on the 15th, so I will order a Motherboard then.

 

[Arkaign]

Check the current issue of Maximum PC, Panda AV 2010 had the highest detection rate, and was much better at nuking spyware than any other traditional AV suite.

Also note that you can only clean so much from scans that don't take place from the infected system, due to registry not being completely accessible and loaded/etc. It's indeed nice to be able to clean most/all of the infected files with the 'pull the drive/scan from different pc' method, but don't forget to finish the cleanup from within the Windows installation on the target pc.

Some other good tools for you :

Rootrepeal (be careful! this is powerful)
IceSword (same)
Combofix (awesome against some things, get it from bleeping computer, and RTFM)
Spybot (good to use in combo with MBAM, they each catch some things the other doesn't, and Spybot has a somewhat useful immunization that adds known baddies to the HOSTS file for blockage)

As for hardware, that 930 is gonna be sweeeeet. I do recommend grabbing an external HDD connector that has an ESATA plug. That will make things insanely faster when you do get to scan a SATA drive. If you look a bit harder, you can also find a converter with power supply that will connect a PATA drive externally to an ESATA plug.

USB 2 is nice enough for many things, but full virus scans/backups/data transfer it's just slow.

 

[Ertaz]

Check the current issue of Maximum PC, Panda AV 2010 had the highest detection rate, and was much better at nuking spyware than any other traditional AV suite.

Also note that you can only clean so much from scans that don't take place from the infected system, due to registry not being completely accessible and loaded/etc. It's indeed nice to be able to clean most/all of the infected files with the 'pull the drive/scan from different pc' method, but don't forget to finish the cleanup from within the Windows installation on the target pc.

Some other good tools for you :

Rootrepeal (be careful! this is powerful)
IceSword (same)
Combofix (awesome against some things, get it from bleeping computer, and RTFM)
Spybot (good to use in combo with MBAM, they each catch some things the other doesn't, and Spybot has a somewhat useful immunization that adds known baddies to the HOSTS file for blockage)

As for hardware, that 930 is gonna be sweeeeet. I do recommend grabbing an external HDD connector that has an ESATA plug. That will make things insanely faster when you do get to scan a SATA drive. If you look a bit harder, you can also find a converter with power supply that will connect a PATA drive externally to an ESATA plug.

USB 2 is nice enough for many things, but full virus scans/backups/data transfer it's just slow.

Thanks for the input. I will check these out. Looking for an x58 mobo now.

 

[Spicedaddy]

As others have said, you'll be limited by the speed of the drive you're scanning (infected drives are usually from older systems running XP with slow HDD), but a good quad will let you do other stuff on your computer while it's scanning.

Also, if you're using a USB to IDE/SATA interface it could be a little slower than plugging the drive directly to a motherboard.

 

[Ertaz]

As others have said, you'll be limited by the speed of the drive you're scanning (infected drives are usually from older systems running XP with slow HDD), but a good quad will let you do other stuff on your computer while it's scanning.

Also, if you're using a USB to IDE/SATA interface it could be a little slower than plugging the drive directly to a motherboard.

I will find a way to have an Esata to ide dock or cable. I am a little upset about the spike in DDR3 prices.

 

[Ertaz]

Picked up the memory today. Now time to scan for that killer deal on an x58 mobo.

 

[Arkaign]

I will find a way to have an Esata to ide dock or cable. I am a little upset about the spike in DDR3 prices.

You could grab something like this : http://www.newegg.com/Product/Produc...82E16817620012

And just leave the case cover off of it, plug and go with whatever drives you need to work with (other than having to power the enclosure off and on to do the PATA drives w/AT power).

 

[Ertaz]

OK. All but the video card has shipped. I'm pretty stoked to have it all here next week.