One of the most common things users do to try and keep their computer running as smooth as possible, is keep control over which programs start with Windows. Having just a few memory or processor hungry programs loading into the system tray on boot can have an adverse affect on the performance of your computer. One of the most common applications that will load with Windows and stay resident in the background while the system is on, will be your chosen antivirus software. Have you ever wondered which are the lightest antivirus packages available and which ones don’t do so well on memory usage?
It’s maybe not such a major issue for newer computers these days having an antivirus which isn’t especially memory efficient because they often come equipped with 4GB or more of RAM. But if your computer isn’t the latest and greatest, using a package which might possibly be eating hundreds of Megabytes of system memory could slow your computer down considerably at inopportune moments. To find out just how much memory gets used by running antivirus software, we’ve decided to gather together a mixture of 25 popular commercial and free antivirus packages to see how they perform.
How We Tested
As you might expect, testing an antivirus product for its memory usage is certainly not an exact science because the program is never standing still and nearly always doing something in the background. A problem with taking memory readings is there are several different numbers you can look at. The two memory readings we paid most attention to were “Working Set” and “Private Working Set” (WS Private), which do two things:
- Working Set – This is the amount of memory used by the process PLUS the amount of memory that is shared with other processes. As such, this value isn’t truly accurate because shared memory can be double counted due to the same resource being registered in multiple processes. It does though represent the maximum amount of non virtual memory in use by the process. This is the default memory column in the Windows XP Task Manager.
- Private Working Set – Is similar to Working Set, but excludes the shared memory. This is only the the amount of memory in use by the process itself and isn’t shared among other processes. Private Working Set is perhaps a more accurate indication of how much physical memory the process itself is using, and is also the default memory column for Task Manager in Windows Vista/7/8.
We decided to approach this task by gathering memory readings over a period of time. 10 readings were taken for each product at 30 second intervals, totaling 5 minutes of monitoring during idle and another 5 minutes while running a scan. The average score was then taken for each antivirus with all processes created by the application added together. All antivirus software was fully updated before testing using windows 7 32-bit, and the memory readings were taken using Sysinternals Process Explorer.
Below are the results for each antivirus package along with the average Working Set and Private Working Set scores in Kilobytes (KB) while idle and during a scan. The software is in reverse order with the heaviest Private Working Set usage for idle and scan combined listed first, going down to the lowest score and most efficient. If you want to jump straight to the list of results to see how your antivirus got on, they are at the bottom of page 2.
25. ZoneAlarm Free AnitVirus + Firewall 11.0.000.504
Number of Processes: 4
Processes Monitored: ISWSVC.exe, vsmon.exe, zatray.exe, ForceField.exe
Idle Working Set (KB): 223,260
Idle Private Working Set (KB): 191,472
Scan Working Set (KB): 287,443
Scan Private Working Set (KB): 226,222
24. Sophos Endpoint Security and Control 10.2
Number of Processes: 7
Processes Monitored: swi_service.exe, SavService.exe, SAVAdminService.exe, ALsvc.exe, ALMon.exe, SavProgress.exe, SavMain.exe
Idle Working Set (KB): 216,482
Idle Private Working Set (KB): 192,436
Scan Working Set (KB): 467,817
Scan Private Working Set (KB): 198,452
23. Emsisoft Anti-Malware 7.0.0.21
Number of Processes: 3
Processes Monitored: a2guard.exe, a2service.exe, a2start.exe
Idle Working Set (KB): 131,158
Idle Private Working Set (KB): 125,337
Scan Working Set (KB): 251,945
Scan Private Working Set (KB): 240,770
22. Quick Heal AntiVirus Pro 2013
Number of Processes: 8
Processes Monitored: ScSecSvc.exe, SCANWSCS.EXE, scanner.exe, SAPISSVC.EXE, QUHLPSVC.EXE, OPSSVC.EXE, ONLINENT.EXE, EMLPROXY.EXE
Idle Working Set (KB): 99,090
Idle Private Working Set (KB): 66,134
Scan Working Set (KB): 273,984
Scan Private Working Set (KB): 227,424
21. McAfee AntiVirus Plus 2013
Number of Processes: 9
Processes Monitored: McAPExe.exe, mcinfo.exe, mcods.exe, McSACore.exe, mcshield.exe, McSvHost.exe, mcsvrcnt.exe, McUICnt.exe, mfefire.exe
Idle Working Set (KB): 142,375
Idle Private Working Set (KB): 103,518
Scan Working Set (KB): 239,500
Scan Private Working Set (KB): 184,214
20. Ad-Aware Free Antivirus + 10.5.2.4379
Number of Processes: 4
Processes Monitored: SBAMSvc.exe, adawarebp.exe, AdAware.exe, AdAwareService.exe
Idle Working Set (KB): 162,540
Idle Private Working Set (KB): 118,728
Scan Working Set (KB): 189,223
Scan Private Working Set (KB): 144,394
19. Bitdefender Antivirus Free Edition 1.0.14.889
Number of Processes: 2
Processes Monitored: gziface.exe, gzserv.exe
Idle Working Set (KB): 115,559
Idle Private Working Set (KB): 91,742
Scan Working Set (KB): 135,836
Scan Private Working Set (KB): 115,795
18. Trend Micro Titanium Antivirus + 6.0.1215
Number of Processes: 6
Processes Monitored: uiWatchDog.exe, uiSeAgnt.exe, coreServiceShell.exe, coreFrameworkHost.exe, AMSP_LogServer.exe, WSCStatusController.exe
Idle Working Set (KB): 102,208
Idle Private Working Set (KB): 72,754
Scan Working Set (KB): 161,926
Scan Private Working Set (KB): 130,022
17. Avira Free Antivirus 13.0.0.3499
Number of Processes: 6
Processes Monitored: avgnt.exe, avguard.exe, avshadow.exe, avwebgrd.exe, sched.exe, avscan.exe
Idle Working Set (KB): 63,754
Idle Private Working Set (KB): 41,138
Scan Working Set (KB): 199,264
Scan Private Working Set (KB): 157,750
16. VIPRE Antivirus 2013 6.2.1.10
Number of Processes: 3
Processes Monitored: SBAMSvc.exe, SBAMTray.exe, SBPIMSvc.exe
Idle Working Set (KB): 114,098
Idle Private Working Set (KB): 91,981
Scan Working Set (KB): 134,488
Scan Private Working Set (KB): 104,936
15. NANO Antivirus Free 0.24.0.52214
Number of Processes: 2
Processes Monitored: nanosvc.exe, nanoav.exe
Idle Working Set (KB): 176,141
Idle Private Working Set (KB): 53,846
Scan Working Set (KB): 287,284
Scan Private Working Set (KB): 131,201
14. ESET NOD32 Antivirus 6.0.316.0
Number of Processes: 2
Processes Monitored: egui.exe, ekrn.exe
Idle Working Set (KB): 93,616
Idle Private Working Set (KB): 76,441
Scan Working Set (KB): 103,244
Scan Private Working Set (KB): 82,913
13. Dr.Web Anti-virus 8.0.8.04230
Number of Processes: 6
Processes Monitored: dwarkdaemon.exe, dwengine.exe, dwnetfilter.exe, dwscanner.exe, dwservice.exe, spideragent.exe
Idle Working Set (KB): 92,006
Idle Private Working Set (KB): 66,822
Scan Working Set (KB): 117,973
Scan Private Working Set (KB): 90,430
Could you please test also Baidu Antivirus 2013?
And how do you select only some processes in Process Explorer (or you modify screen image?)
It would be very nice if you colud select some rows in Process Explorer like in Excel and show you somewhere the sum of parameters, or sort on selected and show sum bellow (maybe you could propose to Mark – author of Process Explorer).
using avast with custom component installed.
avast has 2 processes and consume 40 mb RAM when idle.
though avast is best AV so far.
An AV using more memory doesn’t mean that it’ll cause poor performance than an AV using less memory. Some AV LOAD THEIR VIRUS SIGNATURE into the memory to achieve better performance, while OTHER AV ACCESS THEIR VIRUS SIGNATURE FROM HARD DRIVE. There are more I/O reads/writes with AV accessing virus signature from hard drive and poor performance compare to AV with signatures in memory. As we all know memory is faster than hard drive.
Thanks for publishing the results but it would have been nice if you sorted the results based on values vs. alpha of product names….real PITA to figure our 2nd 3rd etc placements. We use Vipre Ent. and its usage is barely noticed by users even on 5+yrs old HP desktops running XP. However, just because AV is light on resources doesn’t mean it is ‘good’.
Thanks.
I dont go by any data published in websites. I personally tried many free antivirus and I settled with Avira free. For my system it is the lightest. Avast is definitely a resource hog. With Avira my system boots up in less than 30 seconds.
Memory usage is not relevant enough. A lot computers now have 4GB or more so 200MB occupied by an AV is not that much. Most important is CPU use and HDD along with real impact on day to day use.
Apparently you are not working with wide variety of computers, outside the business world. Many ordinary people are using older computers that have good enough CPU processing power, but are bogged down by lack of RAM.
Not everyone buys a new computer every few years and that is actually wise. Sadly, some “wise” nerds force these people to buy a new computer, when actually they only need a RAM upgrade.
Even then, useless RAM hogging is not acceptable. But neither is high CPU and/or I/O usage.
I agree with you, but again, memory is not the only factor to know if an AV is slowing down the system or not. Jason is having a good point explaining about the I/O read/writes on HDD. HDD stays the slowest component of a PC. It would have been nice to go a little deeper in the tests.
Anyway if you look at your tests results it’s actually quite right. WebSecure is the lightest, I tried it for months and it has definitely a low impact of performance, however interface is weird. The new Avast is also surprisingly lite, I need do to more tests but I’m quite satisfied with it. Windows Defender is not present but it also quite fast, however it slows down some operations like copy/paste somehow.
I don’t know Panda, Imunest, Unthreat and Fsecure.
Then the biggest ones, Norton, BitDef, Kasp & company are just gas factory and even if BitDef has a no brainer mode, it still has an important impact on perf. You can see it using some skydrive upload with word or just running quite a few programs and surfing on the web.
using Avast for some time now (1 year or more) as Avira became obtrusive I changed options in Avast to not allow animation of the icon in the tray area nor do I allow or care for any pop ups though some do show but very minimally.
The only time that Avast slows down my computer is when first booting up as it checks for updates which is fine.
I am using XP Pro sp3 x86, 1GB of ram memory on my antiquated socket 939 SLI with 2x Alpha Dog edition 8800GS 384MB video cards with no issues other then the initial boot up of the operating system.
Thank you for this article,very much appreciated.
I will have to agree that process I/O (reads writes) will give you much better results than testing memory.
Most newer system have at least 2GB of RAM which more then enough to run most AV’s without any system slow downs. However when it comes to programs like ZoneAlarm Free Antivirus + Firewall, it doesn’t seem to effect the system response time like Avast Free does even though it uses more memory. on my system. I never have never experienced system lags using ZoneAlarm but I have occasional lags with Avast Free.
Comodo for example is very light on memory usage but kills system response time probably because it has to check all of the process I/O (reads writes) where others only check suspicious process I/O (reads writes). I had to uninstall Comodo because the system lags got to be too much of a problem to handle. This applies to all products that use advanced HIPS, even though they may use little memory they still make your system response time much slower. Testing just memory usage will not give accurate results.
If process I/O (reads writes) was tested you would see much different results. Hopefully Raymond will tackle testing process I/O (reads writes).
Raymond, what’s your view on Agnitum’s Outpost Security?
I’ve been using it since a long time,and it seems quite light on the system…
Avast is a resource hogger – I removed faster than I’ve installed!
I see Avast get great ratings all over the Internet, but if it’s so great, tell me this. Why in the world does it “bog down” the operations of certain machines? This can be at random, new or old PCs, but, whenever you click on a program to start it, you can see the Avast “ball” spin…and spin…and spin before the program actually starts. This can also happen when simply opening a document. I understand the program is “checking for viruses”, but seriously, why does Avast take so durned long to “check”?
At this point, can’t recommend it as a free option to my customers because of this.
Thank you for the article Raymond. I like the Final note which you written. Next time also include Avast internet Security in the test.
Thanks for the article – as other people have mentioned it’d be great to see a comparasion of usage in terms of IO Reads/Writes… disk access time and second processor active time.. Memory these days is cheap (I only have 8GB and even that’s hardly used in comparasion to HDD access time…. but by adding another 16GB i wouldn’t see much of a difference since antivirus keeps wanting to read hard disk directly) … i’d say a lighter antivirus could have a much larger memory cache?
These should also be compared on how effective each finds a virus, which when it does, might also increase memory used; and how long an active scan takes. A program that doesn’t use much memory could be because its designed to find little.
If you have time you should test process i/o (reads writes). It is more important than memory test if you want to know how av affects your system.
I’ve been using Avast! for a couple of years now and it has by far been the best I’ve ever used. I gave up on Norton and McAfee because they were memory hogs, hard to use and not getting along with software. Avast! really made a difference on my memory and CPU and has protected me from all kinds of nasties on the internet. Plus it’s easy to use….
Thanks for the article, Raymond. Interesting and informative as always, Putting this one in my library for future reference.
Would love to see this same article done for android phones. That’s an area where memory usage really needs to be tracked. I’ve tested 1/2 dozen myself and none have been a good fit, in fact some that have memory managers built in seem to slow my phone down…
Not sure Avast flushing it’s memory every ten seconds is that good a thing. For a start I suspect it’s just being flushed to virtual memory. As to Avast being the most popular I have seen loads of people leaving them since Avast 8 was released due to bugs and other issues. I personally left them because they hype themselves more than Apple ever has.
With Avast you can have a cup of tea in between double clicking an office document and it is made ready to work with. Avast may not be a memory hog but most surely a system bog. It has compatibility issues with several other programs also. So, as Raymond rightly pointed out, readers don’t translate these results to the performance of the AVs. What we want is good balance between needs and deeds of the AV.