Is there an AV App that Doesn't Eventually Become Bloatware?

[XMinus1]

Hi,

I've used several Anti-Virus Apps over the past few years:  I was really happy with PC Cillin for a year or two, but then some odd things began to happen to my PC, and I couldn't figure out what was going on.  After doing a bit of net-research I discovered that other PC Cillin users were suddenly having similar problems.  PC Cillin had added new 'features' (i.e. it had become something more than an AV app) and had surreptisiously altered systems to do it's new thing.  The alterations conflicted with other programs.  I dropped it and moved to another AV app (can't remember which one) and, eventually, it too became bloatware, and caused problems with other, more streamlined apps that I'd picked to do certain jobs.  I then moved to Avast, which I've used for a year or two but, just a few weeks ago, I began to experience odd, and inconsistent, problems with secure sites (https).  This one was tough:  I tried shutting down all extraneous processes but I couldn't narrow down the source of the problem.  I suspected (irrationally, actually) that Kerio 2.5.1 had begun to give me issues, and I liked what Mouser had to say about Outpost Firewall, so I switched.  No change.  I uninstalled Spy-Sweeper.  No change.  I then uninstalled Outpost.  No change.  I then uninstalled Avast and voila!  problem solved. 

This is infuriating:  I've spent untold amounts of time solving this problem, and now I have to spend a bunch more time figuring out which AV program to adopt and, of course, I'm certain that whichever one it is I'll eventually have to go through this process again, as it 'evolves' into bloatware, i.e. becomes not only AV but spyware detector, firewall, etc.

One of the most irritating aspects of this was Avast's persistence, even after I told it to shut down:  three Avast processes continued to run after shutting down the app via the menus.  And even after shutting down those processes something in Avast continued to prevent consistent access to https addresses.

What can I use as a one-stop-shop for AV?

My spyware and firewall apps:

1.  Spysweeper (well, it will be, once I reinstall it)

2.  Kerio 2.5.1 or Outpost (not sure which I'll stick with)

Thanks

[4vrqrisPt]

Hi,
I've run into the same problem with bloat.
Norton being one of them.
At the moment I run AntiVir personal Classic (Free)from Avira
http://www.free-av.com/
Even the premium version is very reasonable at about $20 or so/year
This program is very easy on your system.the only thing is a
nag screen when it updates.To me that is no big deal,one click and it's gone.
I'm quite happy with it and it seems to catch the crap
You may want to give it a try.

Pete.

[housetier]

free-av.com (or free-av.de) is what I install on all my friends' PCs; I can recommend it. It's small, and it stays out of your way. My friends also like that little umbrella thing in tray bar: umbrella opend - virus protected; umbrella closed - not protected. It's so obvious all of #em understood it without explainations.

There are frequent updates both for the free and the commercial version. The free version is not lacking anything. You are just not allowed to use it in a company. For private use it is free of charge.

It has proven reliable in the past five years.

[app103]

I'll tell you what I use on my old pc.

First I'll tell you a bit about it's specs so you will be able to understand my dire need to keep the software bloat-free..

Pentium 1, 233mhz
64 mb RAM
Windows ME
CD drive that doesn't read data cd's any more (couldn't install anything that comes on CD)

and now for the name of the only antivirus I would consider for that machine:

AVG Free   

It's light, doesn't cause weird problems, doesn't cause blue screens, doesn't cause the system to lock up if a rar file icon is on my screen, doesn't add 10 minutes to startup time...and it's free!

Switching from McAfee to AVG made my system run faster, more stable, and require a reboot much less often. I went from rebooting every 4 hours, which is typical for most Windows ME machines, to uptimes of over a month. Installing AVG on that machine was one of the smartest things I ever did.

The pay version contains a firewall, which is not what I wanted for the older pc.

Another thing you should know about the free vs. pay version: free version will NOT allow you to exclude files or folders. If it finds something it doesn't like, it will eat it, no matter what it is or how you feel about it. I have had it eat a programming project or 2.  
If you want the ability to exclude files, you have to pay.

You are also only allowed to have 1 copy of the free version installed, no matter how many pc's you own. So if you own more than 1 computer and love this product as much as I do, you'll have to buy it for the additional pc(s).

I use the pay version on my super-duper brand new pc and the free one on the old pc.
I am very happy with both, although I don't use the firewall that is included with the pay one, so I can't rate that part.

If there will be any bloat added to this product, it will most likely be added to the pay version and not the free version. Grisoft has recently acquired Ewido, an anti-spyware company, and plans on adding it to their product line. I don't know if it will be stand alone or added to a future version of their pay antivirus product.

[wr975]

the only thing is a nag screen when it updates.To me that is no big deal,one click and it's gone.

-4vrqrisPt (May 20, 2006, 11:08 AM)

In another forum I read of this registry hack. It should disable the nag screen.

Copy in notepad, edit the path to your antivir installation if necessary, save as "disable.reg", double-click disable.reg to import it in your registry. Done.

[Select]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{3f4dabe0-8061-4eb3-8ae7-265a4c579700}]
"Description"="Disallow start of avnotify.exe."
"SaferFlags"=dword:00000000
"ItemData"="C:\\Program Files\\AntiVir PersonalEdition Classic\\avnotify.exe"

Another way is to use the security tab in file properties of the file "avnotify.exe", and just disallow it to start. But XP Home users don't see this tab (unless they boot in safe mode). So using this registry hack is probably easier.

[4vrqrisPt]

Thanks wr975,

Great find.Yes I heard about this before,but never actually
saw how it was to be done.
Like I said,it doesn't really bother me,but I will try this out
later tonight.

Here's another tip:If you're in N.America,the updates download faster
if you set the updating time for the evening hours.
That makes it early morning for the servers in Germany.
They seem to be less busy at that time.

Pete.

[Hellie]

I have tried PC Cillin ( I spelt that wrongly), Norton, symantec and kaspersky in the past. The best AV I have found is NO32D WWW.ESET.COM. It leaves a small footprint and runs quitely in the background. I have teamed this up with the free www.netveda.com firewall. This is the best combination I have used. I also use the free LAVA Softare Adware Remover, Spyboot Search and Destroy, Spyblaster and Spyguard run in the background. I have also recently downloaded a-squared free adware remover.

Is anyone using anything else?

You can get a free trial of NO32D WWW.ESET.COM antivirus . I would say NO32D and the Netveda firewall are for the more experienced IT user.

Helen

 

 

[f0dder]

LavaSoft ad-aware isn't all it's hyped up to be - they lie about the number of malware they detect (iirc ad-aware multiplies the number of database by 1.2), it's file-scanning algorithm is pretty slow and easy to defeat, etc.

IMHO a better choice is Spybot Search & Destroy which is also free, and doesn't have a big-brother version that costs money.

I personally use NOD32 antivirus because it's a no-nonsense and pretty lean_and_mean program, which also has one of the best heuristic detection engines. Kaspersky is nice as well, but has become a bit bloated, and the way it uses NTFS streams and rootkit-like method for hiding those streams is a bit icky (see sysinternals' rootkit revealer forums).

Big problem with NOD32: it doesn't cache file status, so every time you boot your system, files have to be re-scanned, which makes first-launch of apps pretty slow (AMD64x2 4400+ here, and it *is* noticable >_<). Also, I haven't found a way to disable the background/instant file scanning that persists through reboots.

[Carol Haynes]

The Agnitum Outpost Firewal has an AntiSpyware plugin seems pretty effective and is always being updated. That combined with Webroot SpySweeper (which has a few more functions than the Outpost plugin) and ESET NOD32 AV seem to work pretty well for me without being too bloated.

[Josh]

The problem with bloat is one that will never be solved. As corporations grow, they continue to add to their software, features that their customers request. So, what might seem like bloat to you, is a great feature to another. This isnt just resorting to antivirus programs, but to all software. People call MS Office bloated, but you know, half of those features would not exist were it not for someone requesting them. People praise apps for being lightweight, and "non-bloated", but I find most of those apps lack the polish that many of their "bloated" bretheren have.

Symantec is often referred to as a bloated application developer. I, however, use Symantec Anti-virus corporate edition 10.0.2.2001, and I have not a single complaint about it. It uses 30MB of ram, which I dont consider bloated for a modern pc. I have it running on a system with 256MB of ram next to me and it doesnt negatively affect system performance. Nowadays, when ram is so cheap, 30MB should not be a big deal for any application, especially one as crucial and vital as an anti-virus application.

Now, I do think that anti-virus products should stick to their realm. Yes, its nice that they can detect malware (read: spyware), but I think spyware is an entirely different type of detection and should be left to specialized apps. Now, I wont bad mouth a product for adding spyware detection, as some people prefer all-in-one solutions, and I wont call it bloat, but its just not for me.

Anyways, there is my 2 cents, take it or leave it

[f0dder]

Funny enough, at least last time I checked, the corporate edition of Symantec AV was one of the few pieces of software that they had NOT messed up majorly. But take a look at the non-corporate version - eek.

but I think spyware is an entirely different type of detection and should be left to specialized apps

I used to think that too, but then I sat down and thought a bit about it, and I actually find it quite advantagous if AV handles spyware as well. It will benefit from the always-on scanning engines in the AV (ie, the spyware will be detected before you can run it), it will benefit from the decompression engines in the AV (so a kiddie can't just unpack a piece of malware and use another packer to defeat static file hash), and it will benefit from heuristic analysis engines.

Also, I'd say users are much more likely to get infected with spyware than a "real" virus...

I do think some packages are getting too big and want to combine too many features. I prefer to have one antivirus (or rather, anti-malware) package, another for firewall. And I don't want any of the solutions to be a complete sandboxing system with hooks in every aspect of the OS. Do one job (or a few) and do them relatively well, and keep the bloat down. Thanks

[Josh]

I do think some packages are getting too big and want to combine too many features. I prefer to have one antivirus (or rather, anti-malware) package, another for firewall. And I don't want any of the solutions to be a complete sandboxing system with hooks in every aspect of the OS. Do one job (or a few) and do them relatively well, and keep the bloat down. Thanks

-f0dder (May 21, 2006, 11:02 AM)

Agreed. I guess I should rethink that analysis I made. I guess anti-malware (spyware) is good to incorporate, but only if it can be done properly. Most antivirus vendors only half-ass their implimentation which is the primary reason I had my stance at the a/v and a/s should be separate entities.

[f0dder]

I do think some packages are getting too big and want to combine too many features. I prefer to have one antivirus (or rather, anti-malware) package, another for firewall. And I don't want any of the solutions to be a complete sandboxing system with hooks in every aspect of the OS. Do one job (or a few) and do them relatively well, and keep the bloat down. Thanks

-f0dder (May 21, 2006, 11:02 AM)

Agreed. I guess I should rethink that analysis I made. I guess anti-malware (spyware) is good to incorporate, but only if it can be done properly. Most antivirus vendors only half-ass their implimentation which is the primary reason I had my stance at the a/v and a/s should be separate entities.

-Josh (May 21, 2006, 11:32 AM)

Yeah. I use separate anti-spyware as well (rootkit revealer, kernel hook detection, and spybot S&D). I tend to use those as scan-tools on infected PCs though - having *protection* (integrated in AV) would be nice. But agreed, only if done properly.

[4vrqrisPt]

To Josh,

Thanks for your excellent post.
Overall I agree with you.However,there are a few things I'd like to mention:

The problem with bloat is one that will never be solved. As corporations grow, they continue to add to their software, features that their customers request. So, what might seem like bloat to you, is a great feature to another. This isn't just resorting to antivirus programs, but to all software. People call MS Office bloated, but you know, half of those features would not exist were it not for someone requesting them.

There is a solution to bloat:It's all in the way the programs are coded.As an example take the Mozilla Project.Lets say Firefox or Thunderbird.These are modular.(With plugins or add-ons)
You only add what you want.This leaves the choice of features totally
up to the user,rather than having a huge Program,where half or
more are features that you don't use.
You mention MS Office.For most people it is bloated.
However,when you take the modular approach,eg you would have a central control panel where you could add or remove the features as desired.With the proper coding,you would not have to reboot or even restart the program after you make a change.A simple refresh should do it.
But no,because of their proprietary nature,these developers.from MS
and others,won't change their ways.It's a mindset,nothing else or call it shortsightedness.

As to Symantec,same story.
You say that their Anti-Virus uses only 30MB of ram.Have you really added up all the processes and services that are needed to run this?I think you'll come out with more than 30MB.
Besides that,you're right,it's not the Memory usage as it is CPU usage that is important.
Anyway,with 256 MB of RAM,you can't be running any games or graphics
applications.You"ll soon be stalling(freezing) the whole works.

But in general your comments are well taken.Thanks.

Just another point of view,
Pete.

[f0dder]

IMHO firefox/mozilla is bloated... code bloat, though, not feature bloat. It's still the browser I use, though, because of IE security holes and the few (but important, for me) rendering/compatibility issues that Opera has

[4vrqrisPt]

Hi,I'll make this short since it's a side issue:

IMHO firefox/mozilla is bloated...

That may well be.I only used it as an example of modular usage.
There's no doubt that coding efficiency may well be improved upon.

Pete.

[Josh]

To Josh,

Thanks for your excellent post.
Overall I agree with you.However,there are a few things I'd like to mention:

The problem with bloat is one that will never be solved. As corporations grow, they continue to add to their software, features that their customers request. So, what might seem like bloat to you, is a great feature to another. This isn't just resorting to antivirus programs, but to all software. People call MS Office bloated, but you know, half of those features would not exist were it not for someone requesting them.

There is a solution to bloat:It's all in the way the programs are coded.As an example take the Mozilla Project.Lets say Firefox or Thunderbird.These are modular.(With plugins or add-ons)
You only add what you want.This leaves the choice of features totally
up to the user,rather than having a huge Program,where half or
more are features that you don't use.
You mention MS Office.For most people it is bloated.
However,when you take the modular approach,eg you would have a central control panel where you could add or remove the features as desired.With the proper coding,you would not have to reboot or even restart the program after you make a change.A simple refresh should do it.
But no,because of their proprietary nature,these developers.from MS
and others,won't change their ways.It's a mindset,nothing else or call it shortsightedness.

As to Symantec,same story.
You say that their Anti-Virus uses only 30MB of ram.Have you really added up all the processes and services that are needed to run this?I think you'll come out with more than 30MB.
Besides that,you're right,it's not the Memory usage as it is CPU usage that is important.
Anyway,with 256 MB of RAM,you can't be running any games or graphics
applications.You"ll soon be stalling(freezing) the whole works.

But in general your comments are well taken.Thanks.

Just another point of view,
Pete.

-4vrqrisPt (May 21, 2006, 12:28 PM)

Modularity only works for certain apps. What exactly can you modularize about an a/v? An A/V's only real components are email scanning, fs scanning, and anti-malware. In every major antivirus I've tried (norton, symantec, f-prot, nod32, kaspersky, etc) those are the CORE functions and even those can be disabled so that the functions arent loaded. I've yet to see an antivirus that doesnt let you choose whether or not you use the email scanner, or the anti-spyware modules

And yes, Symantec ONLY uses 30MB of ram. You're response to me indicates you are letting your bias and negative views of symantec cloud the fact that a real world user is not experiencing high memory usage. Here is a breakdown of every symantec process running on my box


CCApp - 8900K
CCEvtMgr - 4376K
CCSetMgr - 5052K
DefWatch - 3624K
VPTray - 8048K

Total Ram Usage: 30000K

So please, dont tell me I dont know how to check what processes an app is using. I can check each process and see where it is installed at. Again, I feel your comment implies to me you have the typical "Anti-symantec user" views, "Oh, its symantec, it must eat alot of ram because everyone says it does".

As for firefox, yes, like you said, its modular, but look at what modularity does in poorly coded apps. It causes memory leaks out the wazoo (in most cases). As I said above, for certain apps, yes, modularity is nice, but for an anti-virus, I dont think its necessary as most allow you a way to disable whatever functions you dont need.

[4vrqrisPt]

To Josh,

I will stop this right here.I will not dignify this with any more
reponses to your post.
Your arrogant and abrasive repose is totally uncalled for.
I'm sorry I misjudged you character.I thought you were a better person than that.

Pete.

[JavaJones]

Keep in mind, as someone else mentioned earlier, Symantec Corporate is vastly different from the consumer version in terms of bloat (it's comparatively lean). I have no problem with Symantec Corporate, but that doesn't meant the widely reported issues of Symantec's home products are not legitimate. In my direct experience they most definitely are.

- Oshyan

[Josh]

To Josh,

I will stop this right here.I will not dignify this with any more
reponses to your post.
Your arrogant and abrasive repose is totally uncalled for.
I'm sorry I misjudged you character.I thought you were a better person than that.

Pete.

-4vrqrisPt (May 21, 2006, 12:57 PM)

Well, I apologize, but I read your post and it felt to me like you were questioning whether or not I knew how to track down memory usage and perform basic pc functions. I apologize if my view of what you said was not how you intended it, but that is how you came across to me. I just get sick of people who cant stand when someone has something good to say about a company/product they dont like. It happens to me all the time at betanews, neowin, slashdot, and other sites, and that is how your comment appeared to me. So, once again, I apologize if that wasnt how you intended that post to come across.

Here, have a beer Let the debates continue!

[mouser]

guys please try to be respectful and keep your powder dry as they say 
we are all friends here.

[4vrqrisPt]

Hi, Yes mouser,you're right.

and to Josh:I appreciate your conciliatory answer.
There was nothing in my original post to indicate an attack on your views.Quite the contrary.Just re-read it.
It's all in interpretation.

Granted,my experience has been with non Corporate- or Enterprise
editions of Symantec.
Even so,if my- or anyone elses experience has been that the software
is bloated or is a memory or CPU hog,they should be able to express that.This in no way indicates a personal attack on somebody's views.

Like I said:"Just another point of view".

We are all users of software.I don't see my role as a defender of a certain piece of software.
I'm not an employee of those companies and even if I were,I would not defend anything that is not quite right.

As to questioning your ability to check memory:It was certainly not meant that way,but it is easily overlooked how many processes or services are involved in the running of certain software.

Well that's it for now

Pete.

[Josh]

Hi, Yes mouser,you're right.

and to Josh:I appreciate your conciliatory answer.
There was nothing in my original post to indicate an attack on your views.Quite the contrary.Just re-read it.
It's all in interpretation.

Granted,my experience has been with non Corporate- or Enterprise
editions of Symantec.
Even so,if my- or anyone elses experience has been that the software
is bloated or is a memory or CPU hog,they should be able to express that.This in no way indicates a personal attack on somebody's views.

Like I said:"Just another point of view".

We are all users of software.I don't see my role as a defender of a certain piece of software.
I'm not an employee of those companies and even if I were,I would not defend anything that is not quite right.

As to questioning your ability to check memory:It was certainly not meant that way,but it is easily overlooked how many processes or services are involved in the running of certain software.

Well that's it for now

Pete.

-4vrqrisPt (May 21, 2006, 02:05 PM)

Again, after re-reading, I understand your point and comments. I am used to being forced to have to "defend" myself against people who are quite ready to attack on the sites that arent as nice as this one where people actually use common sense.

Anyways, You are right, it is quite easy to overlook the processes being used by a program as complex as an a/v. I agree completely with you that the home line of products is indeed becoming top-heavy, but I dont consider it "bloated" yet. Bloated would the inclusion of unnecessary features, and none of the features I see in norton's home line are to the point that I would deem unnecessary or "useless". You just have to remember, a useless feature to one, might be a godsend/make all feature to someone else.

Anyways, glad to see you did indeed respond to me and hope you wont take this as a hit on your impression of my character.

[f0dder]

Anyways, You are right, it is quite easy to overlook the processes being used by a program as complex as an a/v.

Indeed. And the kernel-mode components aren't even visible in taskmgr or process explorer... then there's all the various services that some of the products include (scheduler, on-demand engine, bla bla bla).

Bloated would the inclusion of unnecessary features, and none of the features I see in norton's home line are to the point that I would deem unnecessary or "useless".

Remember that there's both feature- and code-bloat. The home editions certainly suffer from code bloat... sluggish memory/cpu hogs. And aren't they using the MSHTML control for configuration? I remember there was one AV soft doing this, and I think it's Symantec/Norton home edition.

[4vrqrisPt]

Hi, this will be a combination answer to Josh and f0dder:

To Josh:Thanks for your clarification.

I am used to being forced to have to "defend" myself against people who are quite ready to attack on the sites that arent as nice as this one where people actually use common sense.

I understand,but that is purely a personal thing.Nobody forces you to do anything(Government excluded,I guess )
The point being,you have one experience,someone else has another.
That doesn't make either one, right or wrong.

You are right about the perception of "bloat".In a strictly AV application there may be little feature bloat, but then I come
to f0dder's assessment.

[Remember that there's both feature- and code-bloat. The home editions certainly suffer from code bloat... sluggish memory/cpu hogs./quote]
For me that happened to be true,  and also

Anyways, You are right, it is quite easy to overlook the processes being used by a program as complex as an a/v.

Indeed. And the kernel-mode components aren't even visible in taskmgr or process explorer... then there's all the various services that some of the products include (scheduler, on-demand engine, bla bla bla).

I was amazed what I found when you do some digging,
by using Sysinternals Process Explorer or even FaberToys.
I am not referring to any particular program,but many apps are using
components or modules,that show up under Windows Explorer or svchost.
Yet in TaskManager their main executable shows a respectful use of
memory and CPU.But like I said,Windows Explorer may very well have increased its use of Memory/CPU.
The average person will not know what really happened.
It's only when you start digging that you find out why certain apps
are slowing your system.

All this is to say that if one is happy with a certain program,
keep it, if not "out she goes".
For me there is no emotional attachment.
I might defend an author or developer (like "mouser")if I feel
that their integrity is attacked,but as to software,sometimes
there are as many opinions and experiences as there are people

So,back to finding an AV program without "bloat"

Pete.