Twister Antivirus 8 Arrived

There are a couple of new youtube video's testing Twister AV 8 I think they might possibly have shown cpu usage on one of them or possibly both, but it may have only been memory.
https://www.youtube.com/watch?v=ANrAb63wPjU
https://www.youtube.com/watch?v=YsALPMHsWZk

 

I loaded Twister AV 8 up on a clean install to play around with it a bit. My cpu spikes were occasionally in the 20% range. The OS seemed snappy though and it seemed pretty light. I enabled the cloud and proceeded to load software as one would normally do with a new install. I am thinking, this is going really well. Then I decided to install a couple of games... Dealbreaker big time!
This software is not ready for primetime!
It quarantined a number of game files, and could not restore them. I also noted that my license was not carrying over from day to day and if I increased the heuristics above Basic, Twister would crash. The cloud uploaded almost every file I installed on the computer too, meaning I guess that common apps that I use are not commonly used in the East?
All in all I am quite disappointed. On another note I sent support an email detailing some of the problems I had been having with my registration not staying from day to day and the issue with the heuristics settings, and nothing back from them yet.

 

I had tried it for like 3 minutes and it was spiking like the previous version... Honestly, i think they tried to implement too many changes and they are a small company, so they lacked the manpower. So they tried to put new gui, cloud, new behaviour blocker, engine, new heuristics and whatever the rest of "new features" are, all in one version and the result is that they couldn't make it to work as it should for the release date. So now the users act as betatesters...

I will try again the next version, in hope that the CPU spike issue is solved...

 

My experience also.

 

Honestly i would have been quite happy if they just updated the behaviour blocker, tweaked the heuristics and left the engine alone. The real time scanner is what is causing the spikes and in v7 it was light as a feather. And the engine in v7 wasn't bad either. With the beefed up behaviour blocker of v8, i think it would have respectable performance (and for those who want it, the cloud too). Now they tried to sfuff v8 with a gazillion of new features, probably did complete overhaul of the engine, so now it has become a CPU hog.

What a shame. I hope they will fix it before we grow old. Cause given their ultraslow release cycle, i don't want to wait for v9 to see the engine becoming light again.

 

Yeah, it is certainly disappointing. V7 was great, except it wasn't 64bit compatible. Maybe they tried to add too much to V8, but like you said, it isn't the extras that are loading it down. It's the base AV engine.

 

I received an email from support today, asking for a dump file. I emailed them about the problems 5 days ago... I had re-imaged after the problems I had with Twister AV so I was unable to send anything to support. IMO 5 days is way too long to hear back from support on any AV product.

 

From an attempt i did to read the chinese Twister forum, there are more who complain about BSODs, so they must be up to their ears trying to fix this (beta) version. If nothing has changed since v7, the only english speaking dev, is Mr. Chu, who is also in charge of english support. So you are lucky he replied to you... Usually he replied to me within 24h, but i was using his personal email.

 

I heard back from Christine Liang. They must have more english speaking support now.

 

Yeah,wow, business must be going well for Filseclab! In v7 it was "one man show" for the english support.

 

There is a v 8.16 out as of 7 Dicember, missed it earlier.

Will try it in a few hours, although my hopes are low.

I also just noticed this "feature":

Resource Balancing
Automatically balance memory and CPU usage, speed the computer.


Maybe as soon as Twister detects strong CPU, thinks "good, now let's hog it"?

EDIT: Found the release notes, as posted by a dev in the chinese forum (machine translated). No mention about CPU usage, but at least they fixed a BSOD. Still looks like betatesting...

e: December 7, 2012, the major improvements are:
1, to improve the part of the system occasionally blue screen problem.
2, to improve the Windows Security Center to occasionally report Fil start.
3, to improve the real-time monitoring and occasionally closed.
4, around 64 Windows7 under Jinshan guards and MVM conflict.
5, to solve the problems the set occasionally can not get rid of right scanning function.
6, adjust turn off the automatic start core services also will stop automatically start.
7, adjust the tray icon.
8, the integration of the latest virus database.

 

Ok, i installed, updated manually (because the installer was 8.0.0) and i think one can safely say there is an improvment in CPU spikes. In most cases i got 1-3% when loading a page, once i got 16% and an 11%, but i 'd say 1-3% was the norm. In previous version i was seeing much worse spikes.

I wouldn't say it's fixed, but i think it's a step forward. But i have a fairly powerful CPU (6-core), so on weaker CPUs, it would be worse. I guess one could say it's usable, if one really wanted to run it, but on "heavy" pages, you must accept "heavy" spikes.

 

Oh, i don't know if this was before in their site, i surely haven't seen it.

Some documentation!

http://www.filseclab.com/documents/twister8tech_en-us.pdf

It's more of an overview than detailed references to the options you find in the UI, but it's a start.

I am almost tempted to run Twister after all...


EDIT: Oh Lord, it seems the pdf is like machine translated english from chinese!

 

I had a BSOD while changing from the Intelligent Lite skin to the classic. Funny since Twister incorporates "BSOD protection".

Anyway, i m gonna keep it for now, i am doing a full scan with heuristics set to "dynamic MVM" and the "Malcode Advanced Analysis" also checked, curious to see how many false positives come up this time.

I also disabled compressed files scanning from realtime shield, they can't infect you, so why take a lag scanning them realtime...

 

Surprisingly, only one false positive, by heuristics (and heuristics were increased compared to default).

 

Well, the Cloud works! That's the cloud i like. Disabled by default, enabled on demand and uploading what i choose.

 

Is the CPU usage any better?

 

See post #37. In most pages, CPU usage is 1-3% on my CPU. On some heavy pages, it's still high, but i noticed that the 2nd time you revisit it (as long as it's in your browser's cache), the usage stays low. Can't say it's fixed, i 'd say i can see an improvement. For now i 'd say it's usable if you show tolerance. At least i haven't uninstalled it yet.

It's a shame, because RAM usage is ridiculously low. I had left it overnight, with iron updating a page and Twister ate double the CPU time of Iron. Can't say i m happy, but it could be worse.









I will keep an eye today that i will be browsing more and report back.

 

OK, after actively browsing, the result is this:





Which is still "meh" and far away from Avast with just standard shield and behaviour blocker, but, i think that it's usable, at least on my CPU. So, i will actually keep it until further notice and see how things go.

It also definetly seems to settle down a bit with use and doesn't spike as badly as the first time you visit a site.


Too bad i can't install Shadow Defender now that i have an SSD and see it "in action" against malware. Maybe i will try in the next days to find some samples for static scan.

 

Thanks. I will load it up and take a look how the CPU is for me.

 

On my PC, after using it for a day, it's let's say tolerable. If it was another AV, i would uninstall it as "heavy", but i am a Twistee at heart, so i am willing to giver Twister a higher than usual level of tolerance. And i keep telling myself "well, it has multiple defences", in order to fool myself into keeping it.

I think it depends on the CPU. Mine is pretty powerful, on a weaker one i don't know if it will totally hog it or if it scale down to work with it.

But yeah, i 'd say it deserves a try for 10 minutes, much more than the previous versions did.

My suspicion is that the spikes will go down disabling some extension in the realtime scanner. Probably tmp, html or js, which i suppose come a bunch while browsing. But i am too lazy to do it and well, since it's acceptable for me, why lower the defense... But i did disable the scanning of compressed files in realtime, it's overkill.


Oh, the iSmart really works! Once you do a full scan, subsequent manual scans are much faster.

 

does the sandbox act as a sandbox ? or something different

 

any running it on windows 8?

 

I wish there was a comprehensible documentation that would explain better the features, but the pdf that appeared recently on their site, is machine translated from chinese and i couldn't understand anything.

They way i understand it, you cannot put something into "sandbox" on demand.
What happens, is that there is this "Malware Virtual Machine", that from the description should be sandbox-like, which is used in on demand scans if you select it in the heuristics strength field. You can also activate it in realtime scanner, but i am scared to do it given it's already CPU-heavy.

 

See here: In heuristics, you can select: Basic, Static (MVM), Dynamic (MVM) and Max (MVM). Also you can check "advanced malcode analysis". I didn't set to "MAX", because Twister is traditionally trigger happy, so at MAX i would expect many false positives.

This SHOULD use the "sandbox" while it scans.