Security software and system resources

[Deleted member 65228]

Hello all!

I wanted to make this thread to ask, how many of you are actually concerned regarding memory (RAM) usage of security software? I know many people like security software which has good performance and is lightweight on resources in general (e.g. does not feel it is even there even though you're really well protected), but it isn't uncommon to see people focusing on the memory usage of security software even nowadays and making comparisons/judgements.

Your memory is supposed to be used up; there is no point in having memory which never gets used up. Modern systems have around 4-6GB memory in my opinion, and I think between 6-8GB is more reasonable nowadays as we aren't in 2008 - 2014 anymore.

I've seen cases of modern and popular browsers like Google Chrome and Firefox use anywhere between 500MB - 800MB or more, with normal usage. I've opened up Firefox on a system with 4GB RAM running Windows 10 to find 500MB memory usage, and seen much more from Google Chrome before. At the same time, I've seen people dislike security products for maybe using a few hundred megabytes of memory to protect them with amazing components, yet use heavy browsers.

There's a lot of misconception regarding memory usage from security software, too. For example, I've seen very old posts on this forum which demonstrate people having really believed that a product from Norton was using only a few megabytes just because the GUI process was found in Task Manager. The truth is that a lot of security software have a lot more going on than just a GUI and/or a service process in the background; they may inject code into running programs which can increase the memory usage among monitored software and they may also rely on device drivers which will use up memory but won't be found in the scope of tools like Task Manager.

I wanted to make this thread to share my opinion that you should look into just more than memory usage, but focus on CPU and disk usage. Those are two important key aspects which may slow down your system when performing operations, don't just look at memory usage and assume a product is "bad" or "heavy" in comparison to another product, when in actual fact the one that appears to be lighter on memory may not actually be lighter. There are also known and documented tricks which can make a process appear to be using less memory (and can cause more problems when using these techniques).

The more memory a program uses, it has the potential to behave faster, too. This isn't always the case of course, but it can improve speed.

My question is... How many of you are really concerned about memory usage these days? Would you be concerned if your security solution used more than 200MB of RAM, 400MB of RAM, 600MB of RAM, or even a GB? Would you look at other factors such as CPU/Disk usage and how "light" it feels when doing your normal every-day tasks in general without taking those factors into account?

Before I end this thread, I'd also like to quickly point out that security software resource usage may differ between systems. What works for me may not work for you and vice-versa, it is just how it is. Compatibility issues can also have a huge part to play.

Thanks for reading.

 

[Marko :)]

I'm not. I used to be concerned when I had 512 MB and 1 GB of RAM on my main PC. Reason because I was concerned was that, if I had antivirus that used a lot of RAM and then ran a web browser which used a fair amount of RAM, everything would be really slow and often make my PC not responding. It actually happened to me a few times. That's the reason why I don't have an antivirus program on my older laptop with 1 GB of RAM.

Now that I have 8 GB of RAM on my PC, I'm not concerned at all, but I'm still using Avast because it the lightest of any antivirus programs I've tested. I don't feel it when using PC and it's really quiet. In fact, I don't remember last time I got an virus alert.

 

[Daljeet]

Awesome and very informative guide @Opcode

when in actual fact the one that appears to be lighter on memory may not actually be lighter. There are also known and documented tricks which can make a process appear to be using less memory (and can cause more problems when using these techniques).

With the help of tricks, developers can tamper task manager and hide the process from task manager?
Generally, we trust on task manager but a few days ago my friend told me we can tamper task manager as well (hide process from TM)

 

[Deleted member 65228]

With the help of tricks, developers can tamper task manager and hide the process from task manager?

I don't think any reputable security software will actually change the memory usage displayed, that's be highly unethical. However I have seen a few Win32 API level functions used on lesser-known projects to make the memory usage be reduced (by freeing lots of things already in memory) which can cause problems and make the program behave slower. I just put it there as a note that it could be done, not that reputable and well-known products actually do it.

Then again... It isn't unknown that a lot of security software can redirect execution flow of certain lower-level APIs belonging to NTDLL (which pass to kernel-mode routines via a system call, or alternatively the actual kernel-mode APIs depending on OS architecture/virtualisation), and this does provide the ability for an opportunity to hide processes. They tend to protect processes, registry keys (and their values), files on disk and device drivers instead of hide them AFAIK though.

 

[shmu26]

"Would you be concerned if your security solution used more than 200MB of RAM, 400MB of RAM, 600MB of RAM, or even a GB?"
Yes, if it got into the range of several hundreds of MB, I would be displeased, and would assume that there is a memory leak taking place. I didn't buy my RAM just to feed a hungry security app. But I have never seen this happen.
BTW @Opcode thanks for your interesting and informative post.

 

[gin]

no problem with 8GB of ram, i'm more concerned about cpu usage, windows defender example, how to reduce it

 

[TairikuOkami]

Memory - I could not care less with 16 GB and pagefile disabled, cleanmem would take care about memory leaks.
CPU/HDD usage - that is another story, I bet OP meant this one, when talking about performance impact.
I would be willing to accept 5% CPU max, but usually it spikes up to 30-50%, that is just unacceptable.

Windows takes 1,5 GB after a clean install, 900 MB after I apply tweaks, 2-3 GB, with a browser, steam and radio. Hardly noticeable.

 

[DeepWeb]

I don't care as long as I don't see it constantly use CPU or even worse disk usage. To me, it's far worse when an AV reads and writes to my disks constantly.

 

[Deleted member 65228]

Yes, if it got into the range of several hundreds of MB, I would be displeased

I wouldn't be surprised if your current Anti-Virus/Internet Security software already used a few several hundred mega-bytes, even if you couldn't see it by default. Signatures have to be stored somewhere and if a product is constantly unloading signatures in memory and then re-loading a different section too-much then it can cause a noticeable performance impact and degrade scanning speed to a whole new level. For example, disk usage would be increased as well because of the constant read requests to where the signatures are stored.

I bet OP meant this one, when talking about performance impact.

You're 100% right with that! I think that memory usage is not as important as CPU/Disk Usage as long as it isn't completely ridiculous, but I think you understand what I mean.

If your security product is being heavy on those aspects then you can expect a performance decrease and usually it'll be noticeable. Some are better than others with this though and will apply good programming techniques to keep things balanced and have things performed as efficiently as possible to reduce the times of high resource usage for an operation.

To me, it's far worse when an AV reads and writes to my disks constantly.

CPU and Disk Usage increase will be the performance killer. I agree with your opinion, it is the same as mine... Usually I'd care more about read/write requests because the likelihood is that those will cause a performance impact in comparison to reasonable memory usage. Although we'd have to define "reasonable" in terms of memory usage ourselves because some people have different views on what is reasonable and what isn't.

----------------------------

On-demand scanning is a bit different though of course, and it would be reasonable to expect high system resource usage throughout the on-demand scan. The security product would need to enumerate through all the files on the system at the designated targets, as well as scan memory and potentially the registry. Kernel-mode scanning would likely be involved as part of catching out hidden processes/files/registry keys (hidden by a rootkit potentially).

 

[TairikuOkami]

Although we'd have to define "reasonable" in terms of memory usage ourselves because some people have different views on what is reasonable and what isn't.

Of course, since many devices have locked max memory to like 1-2 GB. My boss has actually complained about a slow touchpad, I think it had Windows 7 and 1GB RAM and it had Norton installed, it took 30 mins just to uninstall it. Afterwards, I have installed other AV and it was running like a lightning.

 

[Deleted member 65228]

I think it had Windows 7 and 1GB RAM

1GB RAM only? Damn.

 

[shmu26]

As far as I can tell, Windows Defender is not degrading my system performance, except for:
1 It is scanning (this usually happens when I am off the computer, so I don't care)
2 I am accessing my download folder or some other location with a lot of executables.

Or am I fooling myself about Windows Defender?

 

[BoraMurdar]

RAM usage is not that important nowadays, except if you have less than 2GB. Disk and CPU usage, especially idle, on access or on demand scanning decompression algorithms or unoptimized behavior analysis paterns will slow down your system making it less responsible.
Long story short, unused RAM is wasted RAM.

 

[Deleted member 65228]

Or am I fooling myself about Windows Defender?

All security software will degrade performance in some shape or form, it just depends how bad it is for the user. It'll differ among systems depending on a variety of factors. I think Windows Defender is fine personally and I've used it before without issues, different story for others.

 

[TairikuOkami]

Or am I fooling myself about Windows Defender?

Consider yourself lucky, I have given WD several chances, it failed me on all occasions. Last time my brother brought me the laptop, which was supposedly not working. It took 5 mins just to login and about 1 min to open anything like a control panel, WD was causing 100% HDD usage. I have never considered WD ever since.

 

[Andy Ful]

Consider yourself lucky, I have given WD several chances, it failed me on all occasions. Last time my brother brought me the laptop, which was supposedly not working. It took 5 mins just to login and about 1 min to open anything like a control panel, WD was causing 100% HDD usage. I have never considered WD ever since.

I had the similar issue with a Dell laptop. It was veeery slooow. I debloated it, and that did not help. So I decided to make a fresh installation, and let the Windows 10 do the rest. I even did not install the factory drivers. The result was great. I really do not know what made the laptop to be a turtle, but I know how to transform a turtle to be a rabbit.
Back to the topic. Normally, the RAM usage is important only for computers (especially cheap laptops) with about 2 GB RAM. Such laptops are for sale with configuration: 10" screen, 2GB RAM, 32GB flash memory disk. If you open the web browser with several pages, then you get short in RAM.
The second case is the computer with integrated GPU+CPU. Such configuration requires reserving some RAM (about 1 GB) for GPU when gaming (of course in low resolution).
I have 8GB RAM, and sometimes have RAM problems too, especially when using RAM as a cache in Shadow Defender (4GB) and running Windows 10 into a virtual machine, at the same time.

 

[roger_m]

I'm not concerned about memory use, because I know that slow performance is due to high CPU and or disk usage, not due to how much RAM security software is using. The only exception is for systems with very little RAM. e.g. less the 2GB, and sadly there are some budget laptops which still only come with 2GB of RAM, which is ridiculous. But of course, the majority of systems have much more RAM than that these days.

I always find it rather amusing when I see posts on security forums, from people who are very concerned about RAM usage and are convinced that lower RAM usage equals better performance.

 

[zzz00m]

I will say that I have noticed Windows 10 being a huge RAM hog, compared with Windows 7. I have two Win 10 systems, one with 8GB RAM, and another with 4GB.

After my system boots, at idle without any additional user applications running, the typical memory footprint for my Win 10 systems plus security software is about 2GB.

So that means my 8GB PC uses a baseline of 25% memory for system and security tasks, with 6GB remaining for applications.

That means my poor 4GB PC is already at 50% memory use! I must be careful what I run here, because Windows occasionally pops up low memory alerts.

But as far as performance hits go, it would be CPU and disk usage that would concern me the most. That said, I think anybody running at least a modern dual core CPU produced in the last 5 years, with an SSD system drive, and at least 8GB RAM, should not notice much impact from the typical security software made today.

 

[Deleted member 65228]

I will say that I have noticed Windows 10 being a huge RAM hog, compared with Windows 7.

I 100% agree. Windows 7 was a lot lighter than Windows 10, simply because it wasn't as bloated. There is less going on in the background on Windows 7 by-default.

However, we also need to remember that Windows 10 has internal security improvements which Windows 7 will lack, so it goes hand-in-hand really. I do think Microsoft should cut-down on bloat though...

 

[ForgottenSeer 65219]

Wrong Question, As you know, RAM is among fastest hardware in the system so why not? Let them use more RAM.