MSE - small footprint AV/AM app.

[tedshemyers]

Since I use MSE ver 2 AV/AM I have been interested in just how many resources are utilized by my AV/AM app. In Task Manager

MSERamUse.jpg

MSE ver 2 uses 5608 KB of Ram while my CPU runs less than 1 % while MSE is quietly running in the background.

I would be interested to see how this compares to other free and for pay AV/AM apps, and the 3rd party suites available. If you use other apps, please post your results here.

[Argus]

That's only the UI in the tray. The engine, MsMpEng.exe, is around 60 MB and above (when scanning).

And also; I don't think it's that easy to compare footprint based on allocated RAM, which RAM, and which features does these different AVs have etc.

[tedshemyers]

That's only the UI in the tray. The engine, MsMpEng.exe, is around 60 MB and above (when scanning).

And also; I don't think it's that easy to compare footprint based on allocated RAM, which RAM, and which features does these different AVs have etc.

The allocated Ram I quoted was just for real time back ground operation, not scanning. Also, just looking at basic operation of comparable apps, versus the suites. I realize the suites will be much more, but comparing one suite to another suite may be helpful to some members out there.

Any of the free or not free AV/AM apps should be able to be compared in this manner to get ball park numbers. For example how does MSE compare, to Avast AV/AM or Norton AV, etc. I just thought that perhaps this might be an interesting topic.

[Argus]

That's only the UI in the tray. The engine, MsMpEng.exe, is around 60 MB and above (when scanning).

And also; I don't think it's that easy to compare footprint based on allocated RAM, which RAM, and which features does these different AVs have etc.

The allocated Ram I quoted was just for real time back ground operation, not scanning. Also, just looking at basic operation of comparable apps, versus the suites. [...]

Still, you are only showing processes owned by you, and looking at the memory allocated for the Security client's UI; the check box isn't checked. When I said around 60 MB I wasn't talking about scanning, or updating, just being idle. Its (MsMpEng.exe) System process is not owned by you or me, but it is still part of the AV, in fact it is the core engine. The other thing is just an UI; in many cases you can turn it off (compare for example with AVG Free, and its User Interface running in the tray; it’s possible to close that one and have the AV still running, I think).

2011-01-21_B.png

People have to know what to compare; working set or private bytes etc. (private bytes must be more interesting since they can't be shared); and when they do that, which OS do they use; I'm not sure that the Task manager in for example XP shows the same as Vista and 7, by default. Thus they have to use another tool such as Process Explorer; otherwise they might compare apples and oranges. And finally if one has a UI on 10 MB and en engine on 30 MB, and another has a UI on 3 MB but engine on 20 MB plus a separate email scanner, plus an update module always running, how do you compare the total number of bytes, even if people were discussing the same type of bytes. And does it tell anything about how "snappy" the PC will be? That’s what I meant with being difficult to compare.

[PaulB]

I think Argus is right. The msseces.exe process is simply your system tray interface (UI) to MSE. You need to show the processes from all users to see the main MSE engine (MsMpEng.exe). I'm a little puzzled as to why your UI process is 10 times the size of mine.

TaskMgr.PNG

[Argus]

In fact, I just did a test; I killed the MSE UI process; and thus the UI that we can access in the Notification area or via the Start menu. I then tried to extract a virus test file from an archive (zip). But it wouldn't let me do that.

2011-01-21_C.png

Because the core engine was still running. From the Event viewer:
Name: Virus:DOS/EICAR_Test_File
ID: 2147519003
Severity: Severe
Category: Virus
Path: file:_E:\Download\eicarcom2.zip->(Zip)->(Zip) etc. etc.
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection

Now this is not something I would advise, or use it in such a way, but since there was no way to exit the UI I did this as a test to prove that the detection engine was there and that it was working. And when I started the UI again I got the usual warning via its interface, since it knew what the core engine had found when the UI wasn't running.

[John Gray]

The important point is that Task Manager is showing you the current virtual memory usage of processes; what is the actual figure used at present by one process depends upon what else is running at what priority, and what the other processes happen to require by way of memory - and how much real memory is available to all processes. The Windows Memory Manager does quite a good job of balancing all these things (it ought to, since it's had enough practice since the early days of NT!). If you were able to keep all other variables equal, and compare the resource usage of (say) Norton AV as opposed to MSE, then you'd have your answer - but "keeping other things equal" is the extremely difficult task. As it stands, about the best you can probably have is "a perception" of CPU and memory usage by an AV program, but that's all it really is... IMHO, of course!

[tedshemyers]

This is the kind of discussion I had hoped to start with this thread. I do realize that each person's experience will be different. This does give people a way to look at various AV/AM apps in their own systems to see how these various apps affect their systems. If someone lets say wishes to move to a new app, they may wish to try 2 or 3 options before choosing an alternative. This may present one way to do this. I'm sure many of you learned experts out there can present other options as well. Please continue!

[HansV]

Windows Update finally offered MSE 2, so I allowed it to install. After restarting and updating the definitions, these are my figures:

x489.png