AVG takes about 4 seconds to fire up the AV Engine and scan. I'm running the 16bit version 6 of AVG. I would recommend you to use McAfee. I use version 4.32 for more than a year now and it is as fast as F-Prot. Also it was the first and only AV scanner for several days who was able to detect viruses in pwd protected zip files like bagle. Here is part of my logfile from another server running my own script with stalker communigate pro:
01:07:33.69 4 EXTFILTER(ANTIVIRUS) inp(39): * start virusscan for Queue\1760059.msg 01:07:34.67 4 EXTFILTER(ANTIVIRUS) inp(97): * Found the W32/[EMAIL PROTECTED] virus !!! in Queue\1760059.msg MCAFEE. 01:07:35.28 4 EXTFILTER(ANTIVIRUS) inp(54): * Message Queue\1760059.msg seems to be clean (F-Prot) 01:07:39.28 4 EXTFILTER(ANTIVIRUS) inp(83): * identified I-Worm/Netsky.Q in Queue\1760059.msg With AVG 13:13:21.11 4 EXTFILTER(ANTIVIRUS) inp(39): * start virusscan for Queue\1750545.msg 13:13:22.72 4 EXTFILTER(ANTIVIRUS) inp(93): * Found the W32/[EMAIL PROTECTED] virus !!! in Queue\1750545.msg MCAFEE. 13:13:23.61 4 EXTFILTER(ANTIVIRUS) inp(87): * Infection: W32/[EMAIL PROTECTED] in Queue\1750545.msg FPROT. 13:13:27.96 4 EXTFILTER(ANTIVIRUS) inp(83): * identified I-Worm/Netsky.C in Queue\1750545.msg AVG. I hope this helps to compare the speed. F-Prot is the 16bit Fprot for dos version. Adrian ------------------------------------------------- ----- Original Message ----- From: "Matt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, March 31, 2004 10:38 AM Subject: [Declude.Virus] Faster second scanner needed > As I continue to research opportunities for increasing efficiency in > order to extend the life of my current environment, I have identified > AVG Anti-Virus as one of the biggest processor hogs, and holder of the > most opportunity. F-Prot is 4 times faster, and maybe more efficient > than that when it comes to processor utilization. Outside of > efficiency, AVG has proven to be a good second scanner, and this should > only be an issue if you are approaching the capacity of your > environment. With AVG commented out and only F-Prot running, the peaks > are much shorter and much lower, but I can ride 100% for over 5 seconds > several times a minute during rush hours with both scanners enabled. > > Everything that I've read about Kaspersky seems to indicate that they > are the fastest at detecting new viruses, but their "File Server" > edition costs $370 retail, and 70% of that yearly. I suppose that I > might be able to find this much cheaper through a wholesaleing source. > > My main concern though is efficiency, and I would take an average > scanner if it was the most efficient over the best scanner if it was > average in terms of efficiency. If anyone has some first hand knowledge > concerning efficiency of any of the scanners, please let me know. I > believe this can be tracked by doing the following if you use F-Prot as > one of two or more scanners: > > 1) Change to LOGLEVEL DEBUG in your Virus.config > 2) Wait for three viruses to be blocked (not 1K ECAIR tests, the > real deal). > 3) Change your LOGLEVEL back to it's normal setting. > 4) Compare the times logged for each scanner (you can post them here > or E-mail them to me and I would be happy to decipher) > > I would imagine that with most 32 bit scanners, the difference in time > will be directly related to the processing power required to run the > scanner, or at least that holds true for the comparison between F-Prot > and AVG on my system. Note that the times between systems shouldn't be > compared, only the relative multiple of the second scanner to F-Prot > should be compared, that way you establish F-Prot's time as being the > control. > > I'm primarily interested in Kaspersky, ClamAV and McAfee, in that order, > though I'm welcome to suggestions for other products that don't prohibit > command line scanning of E-mail in their licenses. > > Anecodotal evidence is also appreciated :) > > Thanks, > > Matt > > -- > ===================================================== > MailPure custom filters for Declude JunkMail Pro. > http://www.mailpure.com/software/ > ===================================================== > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
