[Avcheck] A sort of comparision DrWeb vs AVP [was text message shouldn't be
scanned?]
Michael Tokarev
mjt@tls.msk.ru
Sat, 05 Jan 2002 14:45:13 +0300
Michael Tokarev wrote:
>
[]
> Well ok. I did some preliminary meashurements here yesterday and found
> that avp is faster than drweb. On a 6000+ messages maildir consisting
> of postfix's postmaster notifications and a few (~20) admin virus alerts
> (this is my postmaster maildir folder), 12Mb total size, with modified
> "avcheck" that only passes files to a virusscanner (pretty like drwebdc
> in drweb distro, there is no equivalent in avp), on Athlon 1.4Mhz machine
> with 512Mb ram and 10Krpm scsi disks, the results was:
>
> HeuristicOff HeuristicOn
> AvpDaemon 1m18s 1m20s
> DrWeb 1m57s 1m57s
This is for mail files. Yesterday I tried the same test on ~2Gb collection
of random but not mail files. Here are results, on the same machine:
HeuristicOff HeuristicOn
kavdaemon 9m48s 47m32s
drwebd(*) 8m42s 8m56s
(*) drwebd skipped 2 big archives and I didn't rerun it again.
This test is NOT accurate due to (*). But conclusion is clear.
Both virusscanners are pretty the same in speed (the difference
in HeuristicOff mode is due to (*), the difference should go
away if drwebd will scan those archives). Drwebd has slower
mail decoding part, this can and perhaps should be improved.
Kavdaemon uses huge amount of time when "code analisys = yes",
I think this is something different from the heuristic analisys
in drweb. While drweb have this mail decoding implementation,
avp is faster for mail -- about 1.5 times for smal plaintext
messages.
Regards,
Michael.