[Avcheck] A sort of comparision DrWeb vs AVP [was text message shouldn't be scanned?]

Michael Tokarev mjt@tls.msk.ru
Sat, 05 Jan 2002 14:45:13 +0300


Michael Tokarev wrote:
> 
[]
> Well ok.  I did some preliminary meashurements here yesterday and found
> that avp is faster than drweb.  On a 6000+ messages maildir consisting
> of postfix's postmaster notifications and a few (~20) admin virus alerts
> (this is my postmaster maildir folder), 12Mb total size, with modified
> "avcheck" that only passes files to a virusscanner (pretty like drwebdc
> in drweb distro, there is no equivalent in avp), on Athlon 1.4Mhz machine
> with 512Mb ram and 10Krpm scsi disks, the results was:
> 
>           HeuristicOff  HeuristicOn
> AvpDaemon 1m18s         1m20s
> DrWeb     1m57s         1m57s

This is for mail files.  Yesterday I tried the same test on ~2Gb collection
of random but not mail files.  Here are results, on the same machine:

            HeuristicOff  HeuristicOn
 kavdaemon  9m48s         47m32s
 drwebd(*)  8m42s         8m56s

(*) drwebd skipped 2 big archives and I didn't rerun it again.

This test is NOT accurate due to (*).  But conclusion is clear.
Both virusscanners are pretty the same in speed (the difference
in HeuristicOff mode is due to (*), the difference should go
away if drwebd will scan those archives).  Drwebd has slower
mail decoding part, this can and perhaps should be improved.
Kavdaemon uses huge amount of time when "code analisys = yes",
I think this is something different from the heuristic analisys
in drweb.  While drweb have this mail decoding implementation,
avp is faster for mail -- about 1.5 times for smal plaintext
messages.

Regards,
 Michael.