Tip to increase performance while using Kaspersky Internet Security

I have been a long time user of Eset NOD32 Antivirus and Eset Smart Security but have recently switched to Kaspersky Internet Security. I love the added security in KIS but felt my system becamse much slower especially when launching new setup files. It seems that KIS is trying to check the file against its definitions and against the Kaspersky Security Network (Cloud Protection) but this is awfully slow! It takes me around 15-20 seconds to launch EXE files. This doesn't happen with the well known programs but happens mostly with new programs that are probably new KIS!

It takes me for example 30 seconds to launch the Freemake Video Converter setup file while I am running on an SSD for god's sake on a high end Notebook (check sig for specs)

With that said, this time I decided to do something different. While installing KIS, I unchecked the box which enables you to participate in the Kaspersky Security Network by sending info about your programs to Kaspersky. Wow! That made a night and day difference! It's like I bought a new computer! My system is much snappier now and programs and program installations load much faster.

If you have the option to send info about your Programs/System to the Kaspersky Network (which you probably do since that is the default installation method), then simply bring up the Main KIS window, then click on Settings, then follow the steps in the illustration below.

 

Does this turn off cloud protection, or any protection at all? or is only used based on info going to kaspwersky labs from you as users? im 99% sure its the second but never hurt to ask

 

This does disable Cloud protection.

If you want to keep cloud protection on but don't mind a little performance hit since you're submitting everything to the cloud for checking, then what I suggest you to do is do the above trick, install all your software that you need to, then reenable it when everything is setup.

Again, you are not disabling the avntivirus/firewall, you are disabling participation in the Cloud protection AKA Kaspersky Security Network.

I do tend to format a lot and find it takes double the time to install all my software with this enabled.

I am not really worried since Kaspersky Internet Security / Antivirus is the best and most secure amongst any other antivirus I have tested. The Cloud protection is good for people who constantly visit fishy sites and download cracks/warez which I never do so Im not thrilled about Cloud protection.

Add to that, I have MBAM Pro running in the background as a second line of defence so....

 

I thought that KIS had some product ID where they could scan a file and then only have to scan it again if it changes. Is there no way to do this with lesser known files (white list)?

 

It does do that, iSwift and iChecker. It has nothing to do with how well a file is known... it's not like Nortons Quorum.

 

I thought so too but I dunno what's goin' on

Ill give you an example...

I will double click on: Fotosizer v1.34.0.510.exe and the setup launches within a second

I double click on: Freemake Video Converter v3.0.2.3.exe the setup launches after 40 seconds

It seems like Fotosizer is well known on the Kaspersky network and thus launches instantly but Freemake Video Converter gets updated almost every other day, and thus it's never on the network of Kaspersky, and takes agest to launch. Now that is just one example. I have 10s of other apps I install that are all legit freewares and clean

For god's sake it takes Nero v9.4.44.0b 50 seconds to launch

And with the specs you see below, this is shameful. Imagine people with average computers....

 

To reiterate: https://www.wilderssecurity.com/showpost.php?p=2029636&postcount=2

If the executable isn't changed and isn't removed from the Application control list manually, its execution will be immediate.

It's the on execution emulator, rather than sending info to KSN that is causing the delay.

 

The emulator can take quite some time for certain new executables sometimes, but this really doesn't sound that normal to me, I think it's best to open a ticket with support or a topic on their forum to see if this is fixable. If you want to check whether it is KSN slowing everything down or the emulator, if you set KIS to interactive mode you will get a progress screen everytime the emulator tests a new executable. I also think there is a setting somewhere to set a specified time limit for the emulator so it will stop testing when the limit is reached, default is 30 secs AFAIK.

 

The maximum time the emulator can use for analyzing an executable can be configured in General Settings -> Application Control. Getting 30 seconds for all setup executables on that machine does sound like something is wrong though, I usually get times like 20-30 seconds only for large setup executables (multiple gigabytes, like self-extracting archives) and setup executables for almost all other programs are usually analyzed in just a few seconds.

About the cloud, unless I'm mistaken, it should just improve performance since then KIS doesn't have to use the emulator for executables that are whitelisted in the cloud.

 

True, it does take a short while to analyze a new program but after that it should have no effect. I always set it to interactive made and make almost no other changes and with the exception of new programs run the first time, it is by no means any heavier than any other suite I have used. I would say there is either a conflict somewhere or it just doesn't like your machine if you are having overall performance issues. I would agree that you might just want to go ahead and work with their support if the issues are major. I flip-flop between 3 different products and I honestly can say that system slowdown is not my complaint with any of them.

 

Ahh, thanks for the explanation

 

I ran KIS in the past and remember some programs taking a long time to open. I thought the reason was because I had the security settings set very high - maybe to prevent any registry changes, something like that. But every time I opened some programs there was a long delay, like a minute.

 

That's why I did what is mentioned in this little tweak and it helped massively

 

yes but you are actually killing the cloud, if applied on a wider scale it will mean less protection for you and all kaspersky users. Not good...

 

True, Cloud is an extra layer of protection so it is the user's choice.

If he wants to feel 100% safe he may as well leave it on and deal with the slowdown when running EXEs otherwise disable it and have the AV perform like it should.

For all I know, Ive been running AVs for years and never got a virus thanks to common sense browsing and not installing crapware or cracks (all my software is legit/paid licenses) and back in the days, there was no such thing as Cloud.

Talking about Cloud, I know they are not comparable products since Kaspersky is way ahead. But why does Panda Cloud Antivirus not slow your computer down to a crawl? I mean with my high end system / 16 GBM RAM / SSD, my computer literally freezes if I am running a large EXE setup file that is being checked by the cloud.

 

I may be wasting my time but....

If you can reproduce the slow execution of executable files at will, then try disconnecting yourself from the internet and run the executable in question. If it's still slow it's not the Cloud slowing you down but, as I've said on numerous occasions, the on execution HIPS emulation. As Rampastein said, the cloud could only speed things up by skipping on execution emulation of already trusted (via Cloud) files.

 

Interesting. I may give this a shot. I have noticed slow downs with it as well. It even takes awhile to download something like ccleaner or a ninite install file. It actually pops up the screen while its scanning.

 

Not true since 2012 - it only disables that you participate by sending data.
You'll still get KSN/cloud detections (AV) and cloud support for HIPS (program group).

 

@SLE
I have to ask because I'm not sure myself:

These are UDS "push updates" that are received without sending any info on PE file hash/info, correct?

And these are downloaded during regular Update, via KLSRL (bases/ksn/ and bases/hips/)? Again done without any info being sent out to cloud?

 

Of course, but those depends also on users.. If many will optout then program intelligence and reaction will be slower with an impact on all users. So, "I don't care... still works" is the wrong way to see the protection. Each of us can contribute to improving it and make it stronger.

 

I'm not really sure how it works and what is sent, but it was easy to show.

Until KIS 2011 when I scanned a new file (where no signatures exist but KSN detection) i got the FileAV popup with UDS detection. When i diabled KSN in settings there was no detection (until real signatures appeared). Same for application details in HIPS.

Since KIS 2012 I'm also able to get those KSN detections - even if I disable to take part in KSN.

The devs never answered my question if it's a bug or a feature ;-)

Some information (f.e. PE Info/ Hash...) must be sent, otherwise it wouldn't work. Of course sometimes those information are stored in locally KSN databases as you pointed out (because it sometimes even works when you disable internet connection).

But (to stay on topic) it has nothing do to with performance as berryracer first thought.

 

FullAck! Everbody who takes advantage of cloud systems should participate.
If somebody doesn't trust vendor xy he or she should't use software of that vendor.

 

@SLE
I was thinking that when you disable KSN in 2012 it would still get UDS that is "pushed" automatically on client from server and then stored as local UDS cache, even without any info/hash about PE files being sent to server from said client. It would be used to minimize damage from rapidly emerging threats (as to not wait for a DB Update) even for users who disable KSN. I guess it will remain a bit of a mystery until they state what's really going on.
(and I agree on the point of KSN participation and mooching for free)

But, going more of topic here.

 

I posted the question regarding the Cloud Protection protection if I disable the participation in the Kaspersky Security Network to submit my data and the moderator in the Kaspersky Forums replied: