How lean and mean is your security setup?

Discussion in 'other anti-malware software' started by Kees1958, Jan 8, 2013.

Thread Status:
Not open for further replies.
  1. Kees1958

    Kees1958 Registered Member

    Joined:
    Jul 8, 2006
    Posts:
    5,857
    @Bodhitree

    it is like driving through the sound barrier on a bicycle, is just not possible (now) :D , don't let them bug you, you made your point :thumb: Maybe the test program itself has glitches
     
  2. Fuzzfas

    Fuzzfas Registered Member

    Joined:
    Jun 24, 2007
    Posts:
    2,753
    I understand what you 're saying and i m not sold either on this proggie to be accurate benchmark. Too many variables and certainly it's not just about CPU and disk, for sure RAM comes into the play (superfetch and prefetch are enabled on all mechanical HDDs Windows installations and even on SSDs i read that not all superfetch functions are disabled).

    If you have RAMdisk and tweaked for games PC, well, if there's someone that could go under the 0.15 mark, that's you. Mine, as soon as i added Shadow Defender and Avast, became slower (even assuming that the proggie has glitch, it means it still had more lag).

    If you 're not bothered, you could try a snapshot to see what you get.

    But to me, there is a good reason why nobody uses this proggie for official reviews. Too many variables and inconsistent results. It may be useful to show differences in lag, but about absolute numbers, as you say, i wouldn't bet my head.
     
  3. Fuzzfas

    Fuzzfas Registered Member

    Joined:
    Jun 24, 2007
    Posts:
    2,753
    Agreed, there must be a glitch. I don't see how that is beatable. Good catch.
     
  4. CrusherW9

    CrusherW9 Registered Member

    Joined:
    Dec 27, 2012
    Posts:
    517
    Location:
    United States
    You guys are failing to understand that I'm running Firefox :rolleyes:
    Joking aside, how could we possible misconfigure the program? I don't see anything in it that would be causing LOAD times to be faster. Also, Kees mentioned loading Chrome at medium integrity level; I have to open Apptimer "as admin" to bypass my Applocker settings, so I would assume that Firefox is opening with a "High" integrity level because of Apptimer opening as high. So maybe that has something to do with it?

    EDIT: After switching over to my admin account(with UAC at max) and running the program for Firefox, I got:

    C:\Program Files (x86)\Mozilla Firefox\firefox.exe - 5 executions
    2.1663
    2.1324
    2.2645
    2.2004
    2.1407

    It's got to be integrity level related.
     
    Last edited: Jan 9, 2013
  5. JimboW

    JimboW Registered Member

    Joined:
    Oct 22, 2010
    Posts:
    280
    Toshiba laptop: Dual core Pentium B970 @ 2.3GHz with 4GB RAM, Win7 Ultimate 64bit, WEI 4.6

    UAC, EMET(Max including ASLR always on), MSE(Scan incoming only)

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - 5 executions
    0.2956
    0.2646
    0.2495
    0.2647
    0.2647
     
  6. Bodhitree

    Bodhitree Registered Member

    Joined:
    Dec 5, 2012
    Posts:
    567
    Indeed, I was messing with permissions and lockdowns, and seemed to glitch the application to where it wasn't reading correctly, and ridiculous (but fake) times resulted. I think Apptimer is actually quite accurate, but this has to be factored in. Thanks for isolating it. 2.XXX is actually a more 'normal' time for Firefox/Palemoon type of applications.
     
  7. Fuzzfas

    Fuzzfas Registered Member

    Joined:
    Jun 24, 2007
    Posts:
    2,753
    My UAC is also at max, but the application itself can be launched without UAC elevation prompt.

    It could be also that there is some glitch related to Intel CPUs...
     
  8. CrusherW9

    CrusherW9 Registered Member

    Joined:
    Dec 27, 2012
    Posts:
    517
    Location:
    United States
    When you are running under an admin account with uac at max, you are basically running as a limited user until you have to elevate with "Run as administrator" or a program or setting requests it. This is what I did, but when under my lua account, I have to elevate and so it is actually running a high integrity level instead of the medium that you get from executing regularly under an admin account.
     
  9. jdd58

    jdd58 Registered Member

    Joined:
    Jan 30, 2008
    Posts:
    556
    Location:
    Sonoran Desert
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - 5 executions
    0.3426
    0.3113
    0.3426
    0.3582
    0.3426

    C:\Windows\notepad.exe - 5 executions
    0.0462
    0.0617
    0.0617
    0.0460
    0.0617

    C:\Program Files (x86)\Windows Media Player\wmplayer.exe - 5 executions
    0.1243
    0.1396
    0.1085
    0.1084
    0.1554

    I have found that if you don't enter the window name correctly chrome won't close between each run so you end up with 5 open instances of chrome and some nice 0.02xxx - 0.03xxx times. When each instance closes before the next one runs you get the more normal 0.3xxx times.

    Intel P6200, 5400rpm hard disk, 8GB ram, Windows 7 Home 64bit.

    UAC @ max, EMET 3.5, ExploitShield 8.1, MSE, 1806 tweak.

    While not exactly lean since I'm running MSE I've found that disabling realtime protection did not affect the times.
     
    Last edited: Jan 9, 2013
  10. CrusherW9

    CrusherW9 Registered Member

    Joined:
    Dec 27, 2012
    Posts:
    517
    Location:
    United States
    I've tried replicating my results that I got previously and I haven't been able to get consistent 0.2xx times. I tried different integrity levels like I mentioned and also different program names like jdd58 mentioned and I got weird results. Most of the trials where normal 2.xx times but a few would be in the 0.2-.03 range. Weird.
     
  11. Dark Shadow

    Dark Shadow Registered Member

    Joined:
    Oct 11, 2007
    Posts:
    4,553
    Location:
    USA
    Mac OS X moutain lion 10.8.2 Buit in security Gate Keeper at default - Firewall block all inbound connection.Safari with No Java - No Adobe Reader.As lean as it gets.

    Windows is whats in sig but I have no choice as my kids are masters of finding malware.I have to look for it my kids just find with single mouse clicks. Kids suck with computers and shouldn't be allowed to use them until they spend at least a year at wilders.:D
     
    Last edited: Jan 9, 2013
  12. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    4,066
    Location:
    Canada
    AMD Athlon 64 x2 Dual core 4400+ 2.70 GHz processor, 4 GB RAM

    Built in Spring of 2005.

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - 4 executions
    0.8121
    0.7653
    0.7809
    0.7809

    I repeated the above test 5 more times, twice with AppLocker set to Audit only mode, once with Jetico fw disabled, and once with ScriptSafe extension disabled. All times were pretty much the same as above.

    I'm not sure if this test tells me much, other than when compared to other results I'm seeing in this thread, my machine's a veritable Edsel in comparison to modern sports cars :D I'm quite convinced I'm running lean and mean, especially given the times were comparable with AppLocker or Jetico disabled. The main thing is it runs smooth and steady, things work as I expect, rarely ever crashes. I'm good with that :)

    I can't be bothered testing other applications.

    EDIT

    this time I cleared the AppLocker policy then ran the test twice more. I saved ~ 200 ms each test (~0.6880). I then also disabled Jetico and still ~ 200 ms saved. So AppLocker causes ~ 200 ms loss while Jetico has no discernable impact. Considering the security these two products provide, that's a good trade-off.
     
    Last edited: Jan 9, 2013
  13. Bodhitree

    Bodhitree Registered Member

    Joined:
    Dec 5, 2012
    Posts:
    567
    LOL now we find out about those 'elite' times people were so convinced were legit, and got angry when I pointed out that it was IMPOSSIBLE for those to be accurate times. I bet this explains it..
     
  14. justenough

    justenough Registered Member

    Joined:
    May 13, 2010
    Posts:
    1,549
    Tempted to put up some impossible numbers starting with a string of zeros just to tease you Bodhitree. But I'll refrain and act like an adult here.;)

    My previous run with MBAM and WSA turned on was:
    C:\Users\name\AppData\Local\Google\Chrome\Application\chrome.exe - 5 executions
    0.3119
    0.3118
    0.3112
    0.3119
    0.3118

    This time with WSA like before but with MBAM turned off it's:
    C:\Users\name\AppData\Local\Google\Chrome\Application\chrome.exe - 5 executions
    0.3048
    0.3173
    0.2841
    0.3240
    0.2838

    Not much difference there.

    Also tested Notepad:
    C:\Windows\notepad.exe - 5 executions
    0.0518
    0.0528
    0.0488
    0.0508
    0.0558

    and Windows Media Player:
    C:\Program Files\Windows Media Player\wmplayer.exe - 5 executions
    0.0678
    0.0618
    0.0678
    0.0678
    0.0628

    Odd that there are all 8's at the end in those last two tests.

    Edit: Just turned off WSA so now testing Chrome StartPage with no security running and got this:
    C:\Users\name\AppData\Local\Google\Chrome\Application\chrome.exe - 5 executions
    0.1858
    0.1919
    0.1848
    0.1903
    0.1842

    And with all Chrome extensions turned off got numbers that averaged at around 0.1650
     
    Last edited: Jan 10, 2013
  15. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    4,066
    Location:
    Canada
    Just saw this at the bottom of the AppTimer web page:

     
  16. Sully

    Sully Registered Member

    Joined:
    Dec 23, 2005
    Posts:
    3,719
    Here most of my applications open in about 200-400 milliseconds.

    Test was done with bio-genetically engineered synaptic focal lens, repeated thousands of times for consistency on a daily basis for over a year.

    Sul.
     
  17. justenough

    justenough Registered Member

    Joined:
    May 13, 2010
    Posts:
    1,549
    Wow, I obviously need a major upgrade.

    These tests were an interesting exercise. Nothing to cause a major change, but it made me aware of the small effects of running different combinations of security, including browser extensions.

    After these tests I'm going to run Sandboxie and WSA-C without MBAM real-time. Haven't found a way to test opening Chrome with Sandboxie yet, I'll keep looking. Opening Chrome with just WSA-C running, I get an average score of 0.2610 after 15 runs with AppTimer, which seems fast enough for this retro-tech synaptic set-up.:blink:
     
  18. Bodhitree

    Bodhitree Registered Member

    Joined:
    Dec 5, 2012
    Posts:
    567
    This proves what I was saying awhile back, WSA has more of a system impact than people realize, and MBAM itself is almost as heavy as a full suite. I quite using both because of this, WSA started impacting overall system performance and was removed.
     
  19. Kees1958

    Kees1958 Registered Member

    Joined:
    Jul 8, 2006
    Posts:
    5,857
    Sandboxie V 4.01 works with AppTimer , just look at the short cut to start the default browser, click properties and ....

    Put the text between quotes ("C:\Sandboxie\etc") of the shortcut TARGET field without quotes in the APPLICATION box of AppTimer.

    Put the text right after the LAST QUOTE (of the shortcut's TARGET field) in the CMD LINE box of AppTimer. Have fun
     
  20. justenough

    justenough Registered Member

    Joined:
    May 13, 2010
    Posts:
    1,549
    I don't understand. Aren't we talking fractions of a second differences here? Like a tenth of a second with and without WSA?
     
  21. justenough

    justenough Registered Member

    Joined:
    May 13, 2010
    Posts:
    1,549
    Thanks, I'll set that up for some tests this evening. Expecting a big hit with Sandboxie, couple of seconds maybe.
     
  22. Antarctica

    Antarctica Registered Member

    Joined:
    Feb 25, 2003
    Posts:
    2,180
    Location:
    Canada
    Yeah, I wonder if we can measure that when someone is waiting for the application to open?:D
     
  23. Bodhitree

    Bodhitree Registered Member

    Joined:
    Dec 5, 2012
    Posts:
    567
    We are, but some of us are OCD about speed. :eek:

    Seriously though, Fuzzfas's description was about right in terms of what the various speeds mean.. From 0.1800-0.3000 you won't really notice it, etc. He posted a list, and I agree with him.

    I really didn't notice much of a difference between BD, BG, NOD32 and WSA. But EScan the difference was astonishing.. But Kaspersky I did notice, there was a 'drag' on everything I did that was unmistakable. So really, all of the major suites except EScan and Kasp I tested were pretty speedy feeling, and I would run any of those listed without a doubt.
     
  24. Dark Shadow

    Dark Shadow Registered Member

    Joined:
    Oct 11, 2007
    Posts:
    4,553
    Location:
    USA
    Yes Escan was a killer for me.The uninstall couldn't happen quick enough.
     
  25. Noob

    Noob Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    6,491
    How do you guys get those numbers. :rolleyes: :D
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.