Stinger questions

[Neil Gould]

Hi,

After a number of unrelated computers were hit with some FakeAlert malware,
I had the opportunity to run Stinger and other apps and noticed that for
some reason, Stinger takes many times longer to run on a notebook than a
desktop computer. This doesn't seem to be related to the OS version, amount
of RAM available, or whether the computers have single or multi-core
processors. Anyone have insights into why this is?

 

[David H. Lipman]

From: "Neil Gould" <[email protected]>

| Hi,

| After a number of unrelated computers were hit with some FakeAlert malware,
| I had the opportunity to run Stinger and other apps and noticed that for
| some reason, Stinger takes many times longer to run on a notebook than a
| desktop computer. This doesn't seem to be related to the OS version, amount
| of RAM available, or whether the computers have single or multi-core
| processors. Anyone have insights into why this is?

Do you have a 5400rpm hard disk ?

BTW: Stinger does NOT target the FakeAlert/SmitFraud type families of malware.

 

[Neil Gould]

Do you have a 5400rpm hard disk ?

The difference in processing times was too great to account for with drive
speeds or throughput; 4+ hours for notebooks vs. < 1hr for desktops, run on
about a dozen different machines.

BTW: Stinger does NOT target the FakeAlert/SmitFraud type families
of malware.

Stinger and Malwarebytes both found and addressed FakeAlert trojans, but
Malwarebytes found some that Stinger did not on one of the machines. On the
machines I serviced, I didn't see SmitFraud mentioned, if that's
significant.

 

[David H. Lipman]

From: "Neil Gould" <[email protected]>


| The difference in processing times was too great to account for with drive
| speeds or throughput; 4+ hours for notebooks vs. < 1hr for desktops, run on
| about a dozen different machines.

| Stinger and Malwarebytes both found and addressed FakeAlert trojans, but
| Malwarebytes found some that Stinger did not on one of the machines. On the
| machines I serviced, I didn't see SmitFraud mentioned, if that's
| significant.

SmitFraud is a family that really encompasses FakeAlert and other trojans associaterd with
pseudo infections that cause you to install fake/rogue anti malware that are cons for your
money.

Stinger has a limited target range but is mostly for worms and some trojans.

Both MBAM and Stinger logs would bear this out.

Notebooks are rarely as fast as desktops. Especially for "cheap" notebooks.

While you mentioned CPU and RAM, the number of files being scanned was also not a
consideration.

What is important to note here is you really can't compare the desktop to the notebook
beacuse they re not the same.

For all I know the notebook has a TIF of 1GB of 4KB ~ 32KB files and a TEMP folder of
1,000 files and the desktop has a TIF of 50MB of 4KB ~ 32KB files and a leaner TEMP
folder.

 

[FromTheRafters]

Hi,

After a number of unrelated computers were hit with some FakeAlert malware,
I had the opportunity to run Stinger and other apps and noticed that for
some reason, Stinger takes many times longer to run on a notebook than a
desktop computer. This doesn't seem to be related to the OS version, amount
of RAM available, or whether the computers have single or multi-core
processors. Anyone have insights into why this is?

May be the power conservation policy settings. I suppose you could
experiment by setting them to *never*, *never*, and *never* when not
relying on battery power (power supply plugged in).

 

[Neil Gould]

SmitFraud is a family that really encompasses FakeAlert and other
trojans associaterd with pseudo infections that cause you to install
fake/rogue anti malware that are cons for your money.

Stinger has a limited target range but is mostly for worms and some
trojans.

Both MBAM and Stinger logs would bear this out.

Yes, and both logs identified FakeAlert trojans on some machines.

Notebooks are rarely as fast as desktops. Especially for "cheap"
notebooks.

While you mentioned CPU and RAM, the number of files being scanned
was also not a consideration.

What is important to note here is you really can't compare the
desktop to the notebook beacuse they re not the same.

For all I know the notebook has a TIF of 1GB of 4KB ~ 32KB files and
a TEMP folder of 1,000 files and the desktop has a TIF of 50MB of 4KB
~ 32KB files and a leaner TEMP folder.

I agree with much of what you've said, and in general, it's a good guide to
the differences between notebooks and desktops. However, none of the four
notebooks are "cheap" models, though one is much older (an IBM R-30). But,
the Stinger scan time diffferences between the R-30 notebook and the newest
ones with i7 processors was insignificant. Also, all of the desktop machines
have more than one disc drive, so the amount of data or number of files
aren't even closely comparable with the notebooks. Finally, the MBAM and
other programs' scanning times were reasonably the same between the
notebooks and desktops, so my question was mainly about Stinger and what it
may be doing that would account for such differences in scan times.

 

[Neil Gould]

May be the power conservation policy settings. I suppose you could
experiment by setting them to *never*, *never*, and *never* when not
relying on battery power (power supply plugged in).

A good guess, but that is the setting on the two notebooks that I was
scanning.

 

[David H. Lipman]

From: "Neil Gould" <[email protected]>

< snip >

| I agree with much of what you've said, and in general, it's a good guide to
| the differences between notebooks and desktops. However, none of the four
| notebooks are "cheap" models, though one is much older (an IBM R-30). But,
| the Stinger scan time diffferences between the R-30 notebook and the newest
| ones with i7 processors was insignificant. Also, all of the desktop machines
| have more than one disc drive, so the amount of data or number of files
| aren't even closely comparable with the notebooks. Finally, the MBAM and
| other programs' scanning times were reasonably the same between the
| notebooks and desktops, so my question was mainly about Stinger and what it
| may be doing that would account for such differences in scan times.

You'll have to ask McAfee (now an Intel Corp. subsidiary) have have a contact but, he was
with Webwasher which was bought by McAfee and so he probably doen't know the answer.

 

[Dustin]

From: "Neil Gould" <[email protected]>

| Hi,

| After a number of unrelated computers were hit with some FakeAlert
| malware, I had the opportunity to run Stinger and other apps and
| noticed that for some reason, Stinger takes many times longer to
| run on a notebook than a desktop computer. This doesn't seem to be
| related to the OS version, amount of RAM available, or whether the
| computers have single or multi-core processors. Anyone have
| insights into why this is?

Do you have a 5400rpm hard disk ?

I'm thinking they do.

 

[Dustin]

From: "Neil Gould" <[email protected]>



| The difference in processing times was too great to account for
| with drive speeds or throughput; 4+ hours for notebooks vs. < 1hr
| for desktops, run on about a dozen different machines.


| Stinger and Malwarebytes both found and addressed FakeAlert
| trojans, but Malwarebytes found some that Stinger did not on one of
| the machines. On the machines I serviced, I didn't see SmitFraud
| mentioned, if that's significant.

SmitFraud is a family that really encompasses FakeAlert and other
trojans associaterd with pseudo infections that cause you to install
fake/rogue anti malware that are cons for your money.

Stinger has a limited target range but is mostly for worms and some
trojans.

Both MBAM and Stinger logs would bear this out.

Notebooks are rarely as fast as desktops. Especially for "cheap"
notebooks.

While you mentioned CPU and RAM, the number of files being scanned
was also not a consideration.

What is important to note here is you really can't compare the
desktop to the notebook beacuse they re not the same.

For all I know the notebook has a TIF of 1GB of 4KB ~ 32KB files and
a TEMP folder of 1,000 files and the desktop has a TIF of 50MB of
4KB ~ 32KB files and a leaner TEMP folder.

The notebooks processor due to power constraints may also be
significantly slower to due multiple things at one time as compared to
a desktop which doesn't have "don't eat my batteries!" issues.

 

[FromTheRafters]

A good guess, but that is the setting on the two notebooks that I was
scanning.

I can't think of a reason that a scanner would 'care' whether it was
running on a desktop or a laptop - and do anything different as a
result. I can imagine that a scanner might set a priority to its process
and that a laptop might have more competing high priority processes than
a desktop would. In fact I can imagine that laptop BIOSes may have set
drivers (TSRs being passe) for power profiles which in turn may have
been superseded by Windows' settings (yet not actually defeated in the
BIOS).

Anyway, enough wild-assed guesses, please do post back if you get an
answer as it is an interesting phenomenon.