Jump to content

Multithreaded Scanning


Recommended Posts

I've been using Malwarebytes for a while now to fix friends' computers when they get infected with malware. For a while though, I couldn't get it to run on my 64-bit system; today I looked at the website and saw that it does support 64-bit now, so I downloaded it and installed it on my own computer to run a quick scan.

When I started the scan, I noticed that Malwarebytes only uses a single thread while scanning files. I've got an SSD, so I know that the disk is fast enough to feed multiple processors. What about adding multithreading support to the scanning part of Malwarebytes, so that those of us with multicore processors and a reasonably fast disk can get a speed boost? To avoid deadlocks when people have multicore processors + slow disks, you could keep a running speed "score" between all of the threads, and only add extra threads (up to the number of total cores/processors) when the current number of threads (starting at one) is pegging the core/processor it's on.

Link to post
Share on other sites

  • Staff

On the whole though, DaChew's right. On most non-solid state spindle-based hard drives (with moving parts), the disk will be limiting much more than the CPU anyway, and a multithreaded MBAM would sit waiting for the disk with nothing to do. Except for a limited set of users with fast disk access, it wouldn't help much.

Link to post
Share on other sites

True, we forget that for example a 40 minutes hard disk defragmentation usually only needs less than 20 seconds of CPU time (aproximately), malwarebytes does not use much CPU either.

Depending on where the multithreading is implemented, maybe it can be interesting for other MBAM tasks (parallelism on signature checks ?), hard disk scanning will not be the most accelerated part, indeed. The quick search is fast (4-5 minutes on my computer), and the database optimization made scans slightly faster.

Link to post
Share on other sites

On the whole though, DaChew's right. On most non-solid state spindle-based hard drives (with moving parts), the disk will be limiting much more than the CPU anyway, and a multithreaded MBAM would sit waiting for the disk with nothing to do. Except for a limited set of users with fast disk access, it wouldn't help much.

What about scanning multiple disks at once? I know that the disks will be the bottleneck in most systems, but I'm fairly certain that MBAM would be able to make very good use of multiple cores, in one way or another -- either scanning multiple disks at once, using parallel threads to do the signature matching on a file, maybe even some kind of heuristic scanning on files. Throwing extra computing power at the problem (detecting if a file is malware or not) should surely be able to yield some improvements in speed and accuracy.

Again, I've been very happy with MBAM since I've been using it (I've even directed my friends to buy copies of it for the real-time protection), so I'm just trying to brainstorm some ways to tweak the performance a bit :(

Link to post
Share on other sites

You know, it might also be an interesting idea to add an option into the program that would capture some data (say, CPU + memory usage + disk access time for each disk being scanned) once every second, or every other second and submit it to Malwarebytes when the scan is complete. This way, we can have a better idea of where the bottlenecks are in the program across various systems.

Link to post
Share on other sites

  • 5 years later...

Hi RubbeR DuckY (or other MBAM staff member), what's the current status of multithreaded optimization? My experience right now is that during extended length scans it's barely touching the potential of my SSD, and CPU usage floats just at 12.5% - 13%, which equates to one of my eight cores. Using procexp shows that the bottleneck is pretty squarely in the MSVCR100.dll thread, regardless of what stage of scanning it's in.

Link to post
Share on other sites

  • Staff

Over the years (and it’s been a few since this topic was first started! ;-) ) we’ve actually made significant changes and improvements to MBAM, many of which directly tie into performance.  

 

But software being what it is, there’s always room for improvement.  The MBAM development team is actively working on a host of new initiatives to improve overall product performance, both with scanning and other program operations.  Multi-threading is just one of those.  There’s actually some significant work and structural changes involved here though, so it’s a bit of a larger undertaking.

 

So definitely still looking at multi-threading and planning to support this, and these improvements will be rolled out in a future version.  

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.