Kaspersky and MFT usage

Discussion in 'other anti-virus software' started by xpsunny, Dec 27, 2007.

Thread Status:
Not open for further replies.
  1. xpsunny

    xpsunny Registered Member

    Joined:
    Jul 16, 2006
    Posts:
    163
    Hello,

    I've heard that Kaspersky creates lots of indexes for the sake of i-Checker and i-Swift technology.

    In order to check whether I tested it on my friends PC.
    My friend uses NOD32 AV, first I created a disc usage snapshot using perfect disc. Then I installed Kaspersky AV v7.0.0.125 performed a full system scan and then again took disc usage snapshot using perfect disc.

    The results were shocking....Kaspersky generated ample of MFT data!!

    Take a look here before KAV installation:

    http://img242.imageshack.us/my.php?image=beforekisinstallationov8.jpg

    After KAV installation:

    http://img241.imageshack.us/my.php?image=afterkisinstallationcs8.jpg


    Post your comments.....
     
  2. btman

    btman Registered Member

    Joined:
    Feb 11, 2006
    Posts:
    576
    And this means?
     
  3. Firecat

    Firecat Registered Member

    Joined:
    Jan 2, 2005
    Posts:
    7,927
    Location:
    The land of no identity :D
    Well, it possibly has something to do with allegations of Kaspersky influencing MFT fragmentation and hence increasing the need and frequency of defragging. But personally I have never seen MFT issues with Kaspersky. I've only seen the chkdsk issue. :)
     
  4. dawgg

    dawgg Registered Member

    Joined:
    Jun 18, 2006
    Posts:
    817
    okey... and whats the point of this thread? :rolleyes:
    ... the MFT data hasn't increased, only the MFT Zone has... they're different.
    Increasing the Zone doesn't mean anything has been added.
    Increasing the MFT means something's been added.

    Some enlightenment from Perfect Disk's Help File for you... (clearly you haven't done any research into the difference):
    If you think thats "shocking", you need to get out a bit more.
     
  5. xpsunny

    xpsunny Registered Member

    Joined:
    Jul 16, 2006
    Posts:
    163
    But I do not get the point...why is there a drastic increase in the MFT reservoir?
     
  6. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    During scanning iSwift assigns an ObjectID to every file that doesn't already have one (and most don't). These ObjectIDs, which are stored in the MFT, each require 16 bytes of disk space. However, every file that is assigned an ObjectID must also be given a BirthVolumeID, BirthObjectID and DomainID, each of which also consumes 16 bytes, resulting in a total of 64 bytes per file.

    I haven't tested this specifically, but I believe that if you multiply 64 bytes times the number of files in your partition you should have a reasonable estimate of the size increase of your MFT. However, there may be additional factors that I am not accounting for. Please review your MFT's before and after sizes and let me know if my estimate is correct.

    PS: Your second image is not loading.
     
  7. xpsunny

    xpsunny Registered Member

    Joined:
    Jul 16, 2006
    Posts:
    163
    Reuploaded images.
     

    Attached Files:

  8. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    Unless I'm interpreting the graph wrong it looks as though the MFT Zone has increased quite a bit while the MFT itself is about the same size. However, I'm pretty sure PerfectDisk has several tabs full of statistics. What do they show? You can also open the standard XP defrag program (but just choose Analyze, not Defragment) and then look at the report data and compare the before and after statistics, including the size of the MFT and the size of the MFT Zone.

    While you're looking at the PerfectData statistics take a look at the metadata fragmentation, as this tends to increase considerably after running a KAV7 scan.
     
  9. xpsunny

    xpsunny Registered Member

    Joined:
    Jul 16, 2006
    Posts:
    163
    Yeah! There was a 32% MFT fragmentation after performing a full system scan! I think such a high intensity of I/O operation definitely decreases HDD life...
     
  10. Sjoeii

    Sjoeii Registered Member

    Joined:
    Aug 26, 2006
    Posts:
    1,240
    Location:
    52?18'51.59"N + 4?56'32.13"O
    Well, offcourse we can all keep on searching on things to bash the several av companies. kaspersky is certainly a great name to bash at as well. I've been running Kaspersky for several years now and I really don't have had any problems yet. Even while I'm running betas allmost all of the time
     
  11. C.S.J

    C.S.J Massive Poster

    Joined:
    Oct 16, 2006
    Posts:
    5,029
    Location:
    this forum is biased!
    as kaspersky grows, it opens itself to bashing.

    maybe now, people can understand Nortons situation.
     
  12. JasSolo

    JasSolo Registered Member

    Joined:
    May 9, 2007
    Posts:
    414
    Location:
    Denmark
    Exactly!! Good one, Chris :thumb:
     
  13. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    Others have also reported metadata fragmentation, but my observation is that in real life it appears to have no noticeable effect on performance. Also, portions of the MFT are held in both memory and prefetch, so the hard drive I/O might not be as much as you think.

    I would be interested in knowing whether or not you notice any performance changes after allowing PerfectDisk to defrag the metadata. My guess, however, is that any differences will be so slight that they will be completely masked by the overhead of running a full-time virus scanner. Thus, if you attempt to run these types of comparison tests you may first want to temporarily shut down KAV and any other memory-resident file scanners that are running.

    Incidentally, what you are doing is similar to some of early research I performed when I was trying to get to the bottom of the KAV-related chkdsk issues. I'm curious to see how your results compare to mine.

    (Sjoeii, C.S.J, please take it easy, this is a technical discussion, not bashing. You are going off-topic.)
     
  14. C.S.J

    C.S.J Massive Poster

    Joined:
    Oct 16, 2006
    Posts:
    5,029
    Location:
    this forum is biased!
    i disagree, i see many of these threads.

    ive [heard] kaspersky does this to your computer,

    i did this, i tried that on a [friends] machine

    results were [shocking]

    sure, it sounds like a technical question, but ive seen enough of these to know it was simply created to bash kaspersky, thats what i think.

    regarding kaspersky and whatever problems people can surface, if people just use the software, there are no problems, and especially no noticable ones. People hatching-on to a problem with the software, creates threads like this. (almost automatically)
     
  15. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,046
    I agree. Interestingly, while trouble shooting a hardware problem, I had a chance to run chkdisk on my drive with a snapshot that had Kaspersky on it for over a year, and then after a format and clean install.

    Low and behold I did see about a 3 minute delay at the start of stage 2 from the Kaspersky stuff. Significant, naw, chkdsk took almost 3 hours to run on the whole drive.
     
  16. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    The apparent metadata fragmentation might explain the dramatic increase in the size of the MFT zone. Perhaps the ObjectIDs were inserted in an inefficient manner. (The MFT Zone can expand as needed up to a certain point, but it generally does not shrink). I'll have to go in with a hex editor, among other things, to see what's going on. This could get tricky!
     
  17. xpsunny

    xpsunny Registered Member

    Joined:
    Jul 16, 2006
    Posts:
    163
    Thanks for supporting my thread...:)
    I like your understanding nature.

    I tried it on my friends PC, because he uses the latest hardware; and my PC is a bit old one.

    I've known one more thing....Kaspersky version 5 had the capability to delete every index entry during uninstallation...but it took very long....so the feature has been removed from Version 6 and onwards.

    Here is a concrete proof of what Kaspersky does with NTFS volumes....take a look at this huuuuuuuuuuuuuuuuge thread:

    http://forum.kaspersky.com/index.php?showtopic=14995&hl=CHKDSK
     
  18. DasFox

    DasFox Registered Member

    Joined:
    May 5, 2006
    Posts:
    1,825
    That post started over a year ago with what seemed like KAV6.

    I have KAV7 installed and I don't notice any problems.

    Is there any mention on that post that KAV7 has these issues?
     
  19. dawgg

    dawgg Registered Member

    Joined:
    Jun 18, 2006
    Posts:
    817
    Why did you install it on your friend's computer then?.. you've read everyone else talking about it, should have known about it or been aware of the possibilities. A great friend you are installing programs which you think will decrease HDD life
    We were all supporting your thread... posting comments about your first post. hmmm, thanks for thanking us as well... sweet!
    First I thought you were just misunderstood and didn't know too much about what you're talking about; (your "shocking" screenshots). Now it looks like you're just re-iterating what other people have said and seems like you're simply looking to damage its reputation and many people (including you) have seen these threads around for ages!

    C.S.J... I totally agree with your posts here :thumb:
     
  20. xpsunny

    xpsunny Registered Member

    Joined:
    Jul 16, 2006
    Posts:
    163
    Wooooooooops!!

    I see lots of Kaspersky fans here......maybe may people are in "love" with Kaspersky. :D

    Let your love reach the height of mountains.....and the depths of oceans.

    No AV is perfect.....whether its Kaspersky, NOD32, Norton or Live One Care. Why not consider it as a bug thread.....right, so it will not hurt your precious warm feelings for Kaspersky. :)....and one more thing I deeply apologize if I might have hurt your feelings because of my MFT findings.

    And as far as I tested it on "my friend's PC"......it depends upon my mood on whose PC I'll test it.....BTW I tested it on his PC as he is going to buy a new one soon.....and it didn't matter to him. We both are best friends....so it has nothing to do with what I do with his PC...Okay....

    Have a nice day,
    Sunny.
     
  21. dawgg

    dawgg Registered Member

    Joined:
    Jun 18, 2006
    Posts:
    817
    Nothing to do with being fans... you wanted our opinions... we gave it :)
     
  22. Hangetsu

    Hangetsu Registered Member

    Joined:
    Jan 9, 2006
    Posts:
    259
    Some of the problems listed above are legitimate, its counter-productive to assume every thread discussing an issue with KIS is there just to bash them.

    Having said that, when the OP asks for people to "post their comments"... Well, that's sure as heck asking for opinions :D

    I've seen both sides of things on this one. My machine wont run KIS well - I have some of the issues that have been described. However, I'm sure as heck not going to bash them just because my PC doesn't run it well. Note my sig - My wife's PC runs it, and it runs just great there.

    As has been stated here (and elsewhere) many, many times: No AV works well on every PC. Its a matter of finding which one has the right matrix of functionality, performance, and lack of problems for your particular machine.
     
  23. Zombini

    Zombini Registered Member

    Joined:
    Jul 11, 2006
    Posts:
    469
    Dont use Kaspersky on machines where you actually have any high value data like pics, xls etc. Its presents too high a risk. I dont. I use NIS2008 whom I trust, especially after the last 2 Kaspersky's screw ups in a week, one system lockup and one explorer.exe deletion.

    Kaspersky ought to stop bashing Norton on their website and other marketing material and take a good long look in the mirror cause they are screwing up way too often.
     
  24. plantextract

    plantextract Registered Member

    Joined:
    Feb 13, 2007
    Posts:
    392
    and norton should stop posting stuff like kaspersky has no anti-spam component on their website (they fixed it recently)
    this topic is really starting to transform in a kaspersky vs others bashing topic.
     
  25. Hangetsu

    Hangetsu Registered Member

    Joined:
    Jan 9, 2006
    Posts:
    259
    Again, as I just stated, that's on your machine. Saying you're having the problem is legitimate. Saying EVERYONE needs to stay away because your PC is having a problem is wrong.

    There are many, many users that have zero problems with Kaspersky, and they far outweigh the number of users that do have problems.
     
Loading...
Thread Status:
Not open for further replies.