The AntiVir 9 product family will introduce a new scanning mode for the integrated on-demand scanner which we called “Optimized Scan”. Optimized Scan is designed to improve on-demand scan performance on multi core systems. This scan mode must be explicitly enabled in the configuration and will especially use the capabilities of modern multi core CPUs (or systems with multiple single core processors). Note that this check box is available on multi core systems only:

A new feature for speeding up Avira AntiVir: Optimized Scan

The performance gain of course depends on your system resources (RAM, Hard disk and CPU frequency). A quick test on two systems each scanning the complete system and program files partition produced the following results:

In our opinion these are pretty good results. However, Optimized Scan has some drawbacks which we accepted to receive maximum throughput:

• Optimized scan works on multi core systems only
• Logging mode is reduced to “Normal”
• As the CPU cores are heavily loaded the user might notice his system reacting slower than normal

How it works? We can’t tell too much but I can tell you the following: Optimized Scan spawns an additional worker thread (only a single one, so we use only 2 cores right now) which takes over some tasks from the main core.

There’s still room for further improvement. Stay curious what’s coming up next…

Thomas Salomon
Manager Windows Software Development

As mentioned in a previous blog entry, we at Avira are not only trying to offer you outstanding detection rates, we are also putting effort into providing that protection in a way that does not slow your system down more than absolutely necessary. This blog entry will give some numbers to a few of the improvements we recently implemented.

The first scenario is scanning a usual Windows XP install directory, containing around 55.000 typical windows files. The second is a dedicated testbed we use for benchmarking parts of our scanner which contains executables, archives, websites, office files, PDFs, pictures and many other different file types.

Note that most of the optimizations we’ve done are absolutely not specific to these scenarios, although of course the choice of a testbed can seriously skew the results into different directions.

So, let us compare three different versions of the Avira AntiVir Engine:

• 7.6.0.84 : one of the last versions of the old AV7 Engine architecture, released in early April 2008
• 8.1.0.35 : one of the first releases of the new AV8 Engine architecture, released in late April
• 8.2.0.7 : at the time of this writing, the most up-to-date engine

Scantime in an On-Demand Scan

Our first illustration shows the scantime of two on-demand scans performed on both of the mentioned testbeds. Each was scanned multiple times to avoid random influences to skew the result. Also note that the files did reside in the file system cache, so the numbers may seem low to you. The scans were performed on a Intel Core2Duo with 2,66GHz and 4GB of RAM.

File IO Requests when scanning the Windows XP directory (reads and writes, measured with Microsofts Filemon tool)

The second illustration shows the effect our optimizations had on general file IO requests. If you look at the numbers, the load for the Windows IO subsystem has changed considerably between the three versions. This also means less work for your physical harddisk. Of course this is not due to the removal of features or detection but instead by improving our own engine IO management, caching and file access approach. In fact, the later versions have added detection and processing of several formats which were not covered by AV7.

So, as you can see, we are not resting on the laurels of our good detection results. Staying ahead of the pack in terms of speed and system impact is also important.

Marcus Matten
Engine Core R&D