View Full Version : TeaTimer CPU load after startup thoughts
Since many people ask about it, we gave the issue some thoughts as to what could be done about this:
We could display it's acitivity; if it is showing which process it is scanning, that might make it more understandable.
We could remember which files have already been scanned (hash of files) and thus "skip" known ones; would have to clear this cache after each update though since new updates might lead to different results.
Thoughts please :)
md usa spybot fan
2008-07-15, 14:08
PepiMK (Patrick):
To start with, perhaps just an explanation of what TeaTimer is doing when it first starts would help.
For example:
Right now I have 53 processes running and if my Avira Antivir's "Active Processes" scan count is correct those 53 processes are using 2144 files (exe, dll, etc.).
If I run my cursor over the TeaTimer system tray icon I see:
88292 processes blacklisted.
283740 known rating available.
If I were to restart TeaTimer would it compare the 2144 files against the list if 88292 blacklisted processes, the 283740 rated processes, both or are there other things TeaTimer is doing?
You're right, a quick overview might be helpful :)
Those 283740 ratings are those entries from the RunAlyzer database that are of use here (e.g. LSPs are not monitored by TeaTimer, so they're not in the list). These are loaded from TTLassh.sbs.
For each new, changed or deleted registry item, the lassh (hash sum of various of its properties) is calculated, and looked up in this list.
While this includes the MD5 of an associated file, that is very quick, and lookup of the created lassh in a hash table returns a result immediately as well. So this part doesn't take user-noticable time.
The 88292 processes are gathered from the regular detection databases, read from all .sbi files found (if you create your own, that would be more or less those File and DownloadFile rules as described on the OpenSBI wiki, though file paths etc. would be disregarded).
TeaTimer tests every new process it finds against this database of 88292 items, and when you start TeaTimer, it will regard every running process as such a new process. In your case, that would mean those 53 processes, not those 2144 which probably includes both loaded modules and file handles.
As for the speed, this is very similar to what thw new SDFiles.exe is doing, which is slow I have to admit. The changes appearing in 1.6 were mostly to reduce memory usage. By pre-organizing the data in memory, scans per file would be faster, but memory usage would increase. Keeping the in-memory database means slower per-file scans (I'm also thinking on various ideas how this could be improved).
milius.net
2008-07-15, 16:19
hello,
yes, please do so - the more visible information the user gets, the more are we able to find out, report & repair (system) errors ... (if any)
---
in my case: (that's why I came here today :-) )
my system resets / windows crashes without warning whenever teatimer starts - I don't know why yet, but it's everytime I start teatimer manually (it's already taken out of autostart / system start for observation)
once I saw some kind of message: "you have more then 1083 files in temp" or something - then a count down (pretty fast) then my system crashes / resets again ...
I do NOT say that teatime is the result of my system crashes - I had teatimer running before without any probs - but this time (only) it's different ...
it could be some systemfile or virus and teatimer causing some kind of chain-reaction with the anti-virus software or something like this - anyways:
it would be nice to see what files are getting checked by the teatimer so I can find out what file is causing that trouble ...
(spybot 1.6 - winxp sp3)
wyrmrider
2008-07-15, 18:22
Millus
you seem to have a different problem
start a new thread
also post what AV and firewall you run
do you or did you have any older AV or anti spyware installed
did your machine come pre installed with a suite or AV?
run CCleaner to clean up those temp files
appreciate your comments on this topic
md usa spybot fan
2008-07-15, 18:31
PepiMK (Patrick):
Thank you for the explanation.
Both proposed enhancements have merit. The first would allow people to see that TeaTimer was actively scanning during startup and the second should reduce the startup time/utilization except immediately after updates.
I can't think of anything else except possibly ordering the blacklisted processes and doing a binary lookup if it is not already being done.
wyrmrider
2008-07-15, 18:32
Is anyone surprised that T-timer is actually doing its job?
There may be other ways to slice the baloney but for now
you want resident protection- you get protection
you want to clean up afterward then turn it off
ps
other Antispyware programs with resident protection take even longer
you could also run Win Patrol (or similar) which would monitor and tell you something has already infected your system and maybe able to reverse the action
does not have the "lag"
(I run Win Patrol ALSO, IN ADDITION TO A real time Anti Spyware protector)
you could also run System Safety Monitor, a virtual machine, Process Guard or similar
All trade offs and all approaches open to discussion
PepiMK (Patrick):
To start with, perhaps just an explanation of what TeaTimer is doing when it first starts would help.....
Ya, how about a notification balloon, like when you install avast antiviruis, it shows the balloon and does a box pop up that explains what stuff is, so that you know what the icon is and what it does. I think that would be the best option so that people would understand teatimer better upon first install of spybot. If md spybot fan meant something else, then oops, but I think something like i suggested would be a good way to understand teatimer.
I feel really dumb. I read that thread so fast haha, i misunderstood what milius.net meant. I read that thread and that got me onto showing more teatimer information. Disregard my above reply lol. :funny: :oops:
Zer0 Voltage
2008-07-15, 22:51
@wyrmrider: Perhaps you should fully familiarize yourself with the problem reports and history before making any assumptions. This is a case of obvious abnormalities, not a need for trade-offs or alternatives and most certainly not some baloney case of TeaTimer doing its normal job. This is a case of TT needing a fix for a real and verifiable problem.
First, on some systems, the TeaTimer process NEVER recovers. It jumps to 99% on start/restart and stays there. Period. Not for a few minutes. Not for a few hours. Permanently - at least until forced closed the hard way.
On other systems, it jumps to 99% usage at boot and stays there for [at least] a few minutes, but then it does recover. But such a long spike shouldn't even be needed for truly normal activity in the first place.
And unfortunately, until it recovers or is killed, an affected system is unusable because of the CPU flood.
Other programs with resident protection DO NOT take even longer. On systems where this problem exists, every other real-time solution works fine - only TT is showing spikes.
Of further significance is that these problems were introduced during the beta period. These problems were not always present. I know because I originally reported a similar (and likely related) TT crash problem here:
http://forums.spybot.info/showthread.php?t=30453#7
and it was only after that got fixed that the CPU spike issues began. In fact, as I said then, there were no similar TT problems up until RC2 (or maybe RC1). The original problem was not present in beta 1 and 2 and the spikes didn't occur until a fix was put in place for the reported TT crash.
This all seems to be of rather critical importance to any potential resolution...
So what changed in TT between beta 2, RC1, and RC2?
And perhaps since this also never occurred before 1.6, what is TT doing now that it didn't do in 1.5.x?
Once we define what changed, the logical test is to then disable whatever changed and see if the problems persists.
At the very least, a way of displaying - or preferably logging - all TT activity would also be useful (as Patrick suggested). Trying to do that with something like Process Monitor just got too out of hand (generating 50+ Megs of data every few seconds).
I am somewhat skeptical that this will come down to "normal" behavior, however, since on nearly identical systems with the same software and configuration different levels of the problem can occur - plus, like I said, the problem didn't occur with the betas.
FYI, when TT does do something it is supposed to do, it does not spike - even on affected systems. It has a brief but normal resource increase, but that's it. I can only make a permanent spike [at will] by fully exiting and then later restarting it (at least on some systems). Further FYI, I have no TEMP files (auto-scrubbers in place) and usually <40 processes running. So anything TT does should be unnoticeable and instant (which truly normal "doing its job" TT behavior is).
Anyway, thanks very much for continuing to look into this PepiMK. If you need me to help test anything or provide any other details, please just let me know. I may not be available much now though.
Sorry if I posted any redundant info here, but evidently while I was away some people decided to start multiple separate threads for the same related issue... :rolleyes:
@wyrmrider: Perhaps you should fully familiarize yourself with the problem reports and history before making any assumptions. This is a case of obvious abnormalities, not a need for trade-offs or alternatives and most certainly not some baloney case of TeaTimer doing its normal job. This is a case of TT needing a fix for a real and verifiable problem..........................................
...............
I am somewhat skeptical that this will come down to "normal" behavior, however, since on nearly identical systems with the same software and configuration different levels of the problem can occur - plus, like I said, the problem didn't occur with the betas.
FYI, when TT does do something it is supposed to do, it does not spike - even on affected systems. It has a brief but normal resource increase, but that's it. I can only make a permanent spike [at will] by fully exiting and then later restarting it (at least on some systems). Further FYI, I have no TEMP files (auto-scrubbers in place) and usually <40 processes running. So anything TT does should be unnoticeable and instant (which truly normal "doing its job" TT behavior is).
Anyway, thanks very much for continuing to look into this PepiMK. If you need me to help test anything or provide any other details, please just let me know. I may not be available much now though.
Sorry if I posted any redundant info here, but evidently while I was away some people decided to start multiple separate threads for the same related issue... :rolleyes:
It is absolutely clear that there is some terrible bug with TT that makes it spike the CPU.As Zero voltage suggests any normal working need not consume that resource.I hope the spybot team quickly put their heads into action and correct it or the reputation of the software will get affected.In fact I was among the first who posted a thread on the CPU spike but a pity no proper response from the forum.I have for the moment uninstalled Spybot ,and watching for the correction.
Please, try to keep two things separated :)
1. A long time for scanning each process. For this, see the discussion about SDFiles.exe before the 1.6 release. That is a trade-off between reducing the time for loading the database to a third (and using only a quarter of memory speaking of resources) while the time for scanning each file has about doubled, which, for single files, is still an improvement.
That is not a bug, just but a discussable shift of preferences.
2. If TeaTimer never recovers as Zer0 Voltage described, that is a bug.
@129260: a Windows standard notification balloon is indeed what I tried this morning :) While the advantage here is that it is a system standard, it's downside is that the time it is shown has to be specified before showing it; hiding it when the file scanning has finished is not possible right now, so the timeout the balloon will have has to be guessed.
@Zer0 Voltage: the change at RC 2 was the shifting between database loading and scanning time.
I think I'll make that toggleable by a registry tweak to allow easier testing of both methods.
@md usa spybot fan: a proper binary lookup only works with a clear set of data. If we would check every file by MD5 or some other hash that we would have for each file, that would do. But if you take a look at the wiki, there are dozens of methods; most time-consuming are cached using hash lists, but they still need to be calculated.
@topic: what we do have now:
balloon hint on each scanned process, shown for average scanning time of last scanned file.
registry tweak ("ConserveMemory") to toggle between both modes for easier debugging.
registry tweak ("WriteProcessLog") and command line switch ("/verbose") to enable more detailed process scanning logging.
improved the low-memory profile structure to speed up that scan, even though it will never reach the speed up the full structure.
what we need to still do:
possibly port all TeaTimer messages to new balloon method.
cache scan results between seasons (except for scan after update).
improve the low-memory-usage data structure some more.
I even tend to get the more memory consuming variant back into place and keep the slow-but-conservative method as a more or less undocumented feature for users of very old systems that would prefer it, will have to discuss that with the team tomorrow.
One file per second doesn't sound too much or much slower than two files per second, but summed up for 50 files...
(btw, this is why we didn't put 1.6 into the updates today, in case anyone wonders ;) )
PepiMK,
The concept of being able to chose by registry tweak or other method between the two modes (less memory use, slower TT scan/More memory use, faster TT scan) at least enables TT to be optimised for the type of PC it is being used on.
I am less enthusiastic about the balloon notification. Sure, those who like to watch utilities work and who try to understand what the software is doing may like it. There is however arguably more users who simply want what ever protection software they install to do its job as unobtrusively as possible. They don't have the time or inclination to worry about how the protection works and they don't want it to interrupt them unless it is for something critical. They expect it to get on with its task and leave them to get on with theirs (what ever they are using the computer for). Of a group of 6 people I provide support to, 5 fall into this catagory, they are computer users, not enthusiasts. Perhaps you would consider also making the balloon a diagnostic option that can be turned on or off.
wyrmrider
2008-07-17, 01:57
Well I agree with everyone
Greyfox baloon toggle is a good idea
but if there is the hang that Zero finds- well that requires some additional investigation and a fix
60 seconds for start up with big cpu spikes is not a Bug, it's a feature, and that is being addressed
Nagan writes
"It is absolutely clear that there is some terrible bug with TT that makes it spike the CPU."
Read PepiMKs post which was made after yours-
are you finding any of the hanging issues Zero finds?
Nag
What AV are you running, firewall, anything else?
Ok agreed that it(cpu spike) is not a bug and a intended function as the people who are in close contact with spybot say.
My query is when the real time alert is present it will always prevent a wrong file from acting.What is the use in scanning files at the start when a detailed scan option is already available.
I used ESET trial and presently Avira.They go about their jobs without the need for a high CPU usage.
Whatever be the reason people do get paranoid on seeing a consistently higher usage of CPU ,because such a symptom preceeds a crash.Would not know whether it is an improvement.
The best tradeoff should be a scan if need be with the minimum of resource used.
wyrmrider
2008-07-17, 17:09
good points Nagan
It appears that the scan of running processes on first access is what's taking the t-timer-time
As opposed to a system wide scan I do not kow how you can do any useful work till the system is secure
I have confidence in Spybot team getting a grip on this
have you had any issues with sd-helper as others have reported.
I mentioned AV as there have been several posts about alleged interference with AVG 8 or AVG8 anti-spyware additions. I'v seen no such reports for Avast or Antivir
We've moved the other regular hints to standard balloons now as well, which should, as a side effect, make those constant forth and back with resilient software that doesn't accept someone is not accepting their changes less desktop cluttering.
Thanks for the hint that many users don't really want to know about these things as well - I went ahead and added an option to either show them or not to give the user the choice here. The point of it was to show some progress while processes are scanned on startup, so we decided to have it enabled by default.
Caching between seasons works fine now as well, making a rescan only necessary if either the database has been updated, or a file has been changed.
As for choosing between the two methods, we decided that it might be best to automatically switch depending on the memory a machine has available.
We'll be looking at possible improvements to the low-mem method again tomorrow, but after that, we should have a new TeaTimer for testing available here (and I hope the new verbose mode has enough output to even find that permanent stall) :)
We've moved the other regular hints to standard balloons now as well, which should, as a side effect, make those constant forth..................
As for choosing between the two methods, we decided that it might be best to automatically switch depending on the memory a machine has available.
We'll be looking at possible improvements to the low-mem method again tomorrow, but after that, we should have a new TeaTimer for testing available here (and I hope the new verbose mode has enough output to even find that permanent stall) :)
Thanks for the reply and giving the thoughts a look into.But whatever you say people would not like to see a spike of around 50% (in dual core) or more in single core systems.The pertinent question (ofcourse from a totally non-technical angle) is when an antivirus does not need such an extended scan why should spybot do?Scanning memory hardly takes time like any Task Manager will prove.I think Spybot is doing a little more (you are the best judge) in the initial scans.Could you not make them low priority ones or change the method of scan?I have been using spybot and am very impressed with it.This 1.6 is proving a little difficult which I am sure would be sorted out soon.:bigthumb:
md usa spybot fan
2008-07-18, 15:44
nagan:
One point that has not been arisen during any discussions concerning the CPU utilization of TeaTimer is the fact it runs with a priority of "Low". Although it is using a lot of CPU time during startup, I personally have not observed any adverse affects in the performance of other processes during that time.
Incidentally, after the 2008-07-16 updates there appears to be 146536 blacklisted processes vs. the 88292 I cited above. TeaTimer is using more CPU time and yet I have still not seen any adverse affects on other processes during TeaTimer startup.
__________
Side note:
In most PCs the processor (CPU) is the single most expensive component and is generally priced by its speed. Theoretically if it is sitting idle you are not getting the bang for your buck.
nagan:
One point that has not been arisen during any discussions concerning the CPU utilization of TeaTimer is the fact it runs with a priority of "Low". Although it is using a lot of CPU time during startup, I personally have not observed any adverse affects in the performance of other processes during that time.
Incidentally, after the 2008-07-16 updates there appears to be 146536 blacklisted processes vs. the 88292 I cited above. TeaTimer is using more CPU time and yet I have still not seen any adverse affects on other processes during TeaTimer startup.
__________
Side note:
In most PCs the processor (CPU) is the single most expensive component and is generally priced by its speed. Theoretically if it is sitting idle you are not getting the bang for your buck.
Agreed.But the issue is to what extent of time it can possess the cpu.I see some program whose spike is limited to few seconds like eset or avira.Well it would only make sure if there were balloons on what exactly spybot is doing during that time.
TeaTimer-beta-1.6.1.21.zip (http://www.spybotupdates.com/files/beta/TeaTimer-beta-1.6.1.21.zip)
Five .reg files allow toggling of the discussed things (debug mode to have more details in Resident.log; switching between the two scan engine modes).
Balloons are enabled by default, can be disabled from the context menu of the tray icon.
One thing I do still find annoying is that he balloons stay for at least 10 seconds (or was it 15)? That's a Windows limitation designed to make sure the user notices them, smaller values are not possible. I added a final "All new processes have been scanned" message to avoid the impression that the last process would take very long compared to earlier ones.
As for the reason this takes longer: Spybot-S&D is optimized for doing a full system scan, not exactly for scanning single files. Antivirus applications do build one or few hash values of a file and look that up in their database. Spybot-S&D is much faster for the complete scan, but slower on individual scans ;)
md usa spybot fan
2008-07-20, 17:52
PepiMK:
Looks good to me (I did not test the debugging and scanmode options yet). Very speedy on a restart after initial scan.
Et al: MD5 of TeaTimer-beta-1.6.1.21.zip (http://www.spybotupdates.com/files/beta/TeaTimer-beta-1.6.1.21.zip) 67D9537F05F67CE1798BD212B0A5FD68
Teatimer beta 1.6.1.21
Query re terminology.
Fast scan is currently ConserveMemory=1
Slow scan is currently ConserveMemory=0
To conserve memory is to limit the amount used. To me Slow scan (conserving or limiting memory) should be ConserveMemory=1
Is there a possibility the files are cross named?
@md: thanks for posting the hash :)
@Greyfox: oh, indeed, you're right! The two files are mixed up.
Will the normal updates be applicable to this beta version or is it just a standalone for testing purposes.
That's just a standalone download link for those interested in the discussion here. Feedback in a dedicated thread usually is much better than waiting for feedback on a regular beta file in the updater :)
md usa spybot fan
2008-07-21, 17:26
PepiMK (Patrick):
I believe that the following question by nagan (http://forums.spybot.info/member.php?u=38016) may be referring to the weekly include file updates (.sbi and .sbs files):
Will the normal updates be applicable to this beta version or is it just a standalone for testing purposes.
If the reference is for the weekly include file updates, I assume the answer is: Yes, the weekly include file updates will be use by Teatimer beta 1.6.1.21. Is that correct?
Ah, ok. In that case: your assumption is correct!
It needs the same files the regular TeaTimer.exe needs, so the best way to try it is to e.g. rename the existing TeaTimer.exe to TeaTimer.exe.bak und put the new file in its place.
(btw: if placed in any other location, TeaTimer would still read the installation location from the registry to be able to locate the databases)
The 1.6.1.21 beta version of Teatimer seems to work fine on my 2.4GH Core 2Duo computer - 1Gb memory. I'm currently running it with ConserveMemory=0, and the scan speed is quite fast. Having now been through a number of reboots and the PC having been used for a reasonable period there is only a very brief scan occurring now at each bootup (the "cache" working as planned?) and the shut down delay of the bubble is now the slowest item. (I specifically haven't turned this off yet whilst trialling the new version, although that would be my preferred normal mode.
I did an initial test with ConverveMemory=1 before changing this to the current mode, however even when Teatimer is disabled and then subsequently re-enabled it doesn't now seem to be scanning as many processes as it did when I first installed it. Does unticking Teatimer in Tools/Resident and later re-enabling clear Teatimer's cache, or is there another way if doing this so I can obtain a start from scratch scan for each different settings option?
To add to my previous post -
With ConserveMemory=0 Teatimer' memory usage (as shown in task manager) was 169,376K.
With ConverveMemory=1 it was 34,968K. In this mode it does take a little longer to complete scanning processes at bootup, but is still not a problem on this PC.
Yes, very brief scan on bootup sounds like the cache ;)
The only way to clear it would be to delete the file C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ProcCache.sbc, or download an update (the cache is completely reset when loading again after an update, since a new update might recognize bad file that wasn't recognized before the update).
My tests were usually around 25 vs 100 MB. Not sure if that included the latest Beta.sbi, if not, that would probably explain the difference, the next update (available as beta since last Wednesday) includes a huge jump ;)
..The only way to clear it would be to delete the file C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ProcCache.sbc....
Thanks, that was what I was looking for
PepiMK (Patrick):
I believe that the following question by nagan (http://forums.spybot.info/member.php?u=38016) may be referring to the weekly include file updates (.sbi and .sbs files):
If the reference is for the weekly include file updates, I assume the answer is: Yes, the weekly include file updates will be use by Teatimer beta 1.6.1.21. Is that correct?
If I understood this properly,I should be able to use the beta as the regular Spybot?But the size of the beta file is anly 2 MB,whereas the original is around 10 mb.Can you clarify please?
Nagan,
The Teatimer beta release is only a patch, not a full spybot installation. The .zip file contains a replacement Teatimer.exe file and a number of registry patch files to allow changes in configuration.
To install the teatimer beta I would recommend first unticking Teatimer in Spybot Tools/Resident, then renaming the existing Teatimer.exe in C:\Program Files\Spybot - Search & Destroy. I renamed mine OldTeatimer.exe.
After that, just copy the new Teatimer.exe into the folder and then retick it in Spybot and my preference is to then reboot.
Note: to see teatimer.exe you will need to unhide system files - don't forget to rehide them again after.
Finally: Whilst it seems fine at the moment, as with all beta releases, there is no guarantee that it is bug free - that after all is what beta is all about. If you are not comfortable with this stay with the official release versions.
Nagan,
The Teatimer beta release is only a patch, not a full spybot installation. The .zip file contains a replacement Teatimer.exe file and a number of registry patch files to allow changes in configuration.
To install the teatimer beta I would recommend first unticking Teatimer in Spybot Tools/Resident, then renaming the existing Teatimer.exe in C:\Program Files\Spybot - Search & Destroy. I renamed mine OldTeatimer.exe.
After that, just copy the new Teatimer.exe into the folder and then retick it in Spybot and my preference is to then reboot.
Note: to see teatimer.exe you will need to unhide system files - don't forget to rehide them again after.
Finally: Whilst it seems fine at the moment, as with all beta releases, there is no guarantee that it is bug free - that after all is what beta is all about. If you are not comfortable with this stay with the official release versions.
Thanks for the fast reply.I love this forum.Any ideas where the bugs of the beta are listed so that I can find or contribute?
Nagan,
Any problems that are found with any particular beta are usually posted in the forum thread relating to the beta (or perhaps in the project tracker thread). In the case of this Teatimer beta, they would be in this thread however if you read right through the thread I think you will see that apart from a couple of the registry configuration patches being interchanged, there have been no problems notified.
I have this beta on two PC's in a home network, one with a fast dual core processor with XP-Home SP3, the other a portable with a much slower solo processor and XP-Home SP2. Another PC in the network is running with the standard Teatimer. I have run Teatimer in both the "memory conserving mode" and the "fast use more memory mode" on both without any problems, but then both these PC's have 1GB memory. It would be nice to hear from someone running a trial on a memory starved platform.
The information being shown in the bubble is nice, in that one gets an understanding of what is actually going on. It's a pity the bubble remains up so long after the Spybot event has finished, but as PepiMK said early on, this is a function of the Operating system and not the Teatimer software, but there is provision to disable the info balloons, which reminds me I have yet to try that!
Hope this helps
tanstaafl
2008-07-25, 13:00
Hello,
Will this new version of Teatimer - and future updates to Spybot S&D 1.6 engine - be updated via the Updater engine? Or will new major versions have to be updated by uninstalling old version then installing new version?
Thanks for Spybot! The new version 6 is much faster on scans...
Edit: Oh, I've only seen one instance of Teatimer pegging the CPU at 99% out of about 15 installs, and at the time didn't have time to troubleshoot, so just downgraded back to 1.5.2... glad to see this is fixed now!
caterwaul
2008-07-25, 18:33
Nagan,
... It would be nice to hear from someone running a trial on a memory starved platform....
I understand that Spybot is "freeware" and totally appreciate the developers extending this excellent Spyware application to the public like they do and I would add that the effort to make this application available to those who still use older systems for one reason or another is equally appreciate and very commendable as well... but...
I really cannot imagine that the developers would not have access to something like a 386 computer w/ a WIN95 OS w/ from 50-150 mhz and 32-64 MB RAM resources considering that this platform would be virtually worthless and could be acquired absolutely free in order to bench test the Spybot application version upgrades. Clearly this would be by far the better method of testing version upgrades as opposed to leaving it to users who could have all kinds of other unrelated issues w/ their respective computers that would impact performance that would have nothing to do with the Spybot application at all.
Clearly if Spybot would work on that kind of "resource starved platform" as you put it then any specific Spybot version should work on any Windows platform as far as resource requirements are concerned.
caterwaul
2008-07-25, 19:27
Just in case this might help....
As far as my issue w/ the system crashing at shutdown w/ Teatimer running using either v 1.5 or 1.6 this ONLY happens if I have launched (not even done anything w/ it) the Spybot main application interface sometime prior to shutting down. If I have NEVER launched the Spybot main interface program then I can shutdown w/ Teatimer running w/ a crash. I can't say that I have allowed large time intervals to occur but when I boot up and then shutdown w/ teatimer running and have not used the Spybot main interface then the system will shutdown properly but if I boot up and then go into SpyBot and do NOTHING else but EXIT the program and then shutdown the system will crash (blue screen VxD error 5) if I leave Teatimer running (but will not crash if I "exit" teatimer manually). Again I can't say that his holds true over a longer time frame but trying each scenario one after the other it is consistent.
It would seem like by launching the Spybot interface that something gets "left behind so to speak" or something is not "closed properly" for some reason because of the fact that I can shutdown w/ Teatimer running and the OS doesn't have a problem if I have never used the main Spybot interface application prior to shutting down. On the other hand if I've used the main Spybot interface at any time then I would have to "exit" Teatimer to be able to shutdown properly.
caterwaul
2008-07-25, 22:12
Sorry but the ridiculous 15 minute limit on edits is really a problem.
I made a typo that meant the exact opposite of what I meant to say.
If I have NEVER launched the Spybot main interface program then I can shutdown w/ Teatimer running w/ a crash
What I meant to say is "... I can shutdown w/ Teatimer running w/OUT a crash.
To bad edits aren't allowed (the only forum I know of that does this and I'm a member of many forums) when a typo means exactly the opposite of what the intent was... :sad:
md usa spybot fan
2008-07-26, 00:53
caterwaul:
re:
I understand that Spybot is "freeware" and totally appreciate the developers extending this excellent Spyware application ... but ...
I really cannot imagine that the developers would not have access to …
Clearly if Spybot would work on that kind of "resource starved platform" …
What you are saying has some merit to a certain extent. "Team Spybot" has attempted to maintain code compatibility with older versions of Windows. However, if your implication is that "Team Spybot" should stop development of new versions Spybot that do not run on a "resource starved platform", than I totally disagree.
Malware purveyors are developing new threats on a daily bases. Unlike in the past where a majority of malware just presented unsolicited adware when accessing the internet and that malware was easily corrected, today's threats involve a whole new level of sophisticated attacks to acquire information that can lead to identity theft, credit card fraud and even the empting of bank accounts.
If the code in Spybot is not capable of thwarting (preventing) or eliminating those threats because it is limited to the lowest denominator of the most "resource starved platform" it may become useless to a majority of users.
Patrick M. Kolla, the developer of Spybot started this thread to address concerns with the CPU utilization of the latest version of TeaTimer. I believe that he has addressed those concerns for a majority of the users of Spybot.
__________
While I was formulating a response to your original post (above) you posted this:
Just in case this might help....
As far as my issue w/ the system crashing at shutdown w/ Teatimer running using either v 1.5 or 1.6 this ONLY happens if I have launched (not even done anything w/ it) the Spybot main application interface sometime prior to shutting down. ...
Now that post has been followed by:
Sorry but the ridiculous 15 minute limit on edits is really a problem. …
Patrick M. Kolla, the developer of Spybot, started this thread to address concerns with the CPU utilization of the latest version of TeaTimer. He addressed those problems and released a beta version of TeaTimer that I believe may address the concerns of a majority of the users concerning the CPU usage of the latest version of TeaTimer.
Your issue appears to be with the fact that you are running Spybot on a "resource starved platform" and not the TeaTimer CPU utilization issue being addressed in this thread. Rather than hijack this thread and divert it from an issue that may affect a vast majority of users, I respectfully request that you confine your comments to either of these two (2) threads that you started:
This thread you r started today:
1.6 didn't work any better than 1.5
http://forums.spybot.info/showthread.php?t=31546
---or ---
The thread you started earlier:
It is settled SBv1.5 does not work for me!
http://forums.spybot.info/showthread.php?t=29644
Your consideration would be appreciated,
md usa spybot fan
As far as I am concerned, the beta version of Teatimer is definite improvement over the Teatimer that was part of the 1.6.0.30 Spybot release, and my question now relates to when and how it will be released.
The current default setting is the "scan mode slow or memory conserve mode" which would perhaps make life easier for those with slower CPU or low memory platforms, but would not offer the improved performance for those of us with modern computers. Whilst I don't think this is an optimum situation, I guess it is the safest one.
Presumably the revised Teatimer could be issued as part of an auto download, running in it's default mode, however users who may not be aware of this beta topic would then not be aware of the other mode or how to patch the registry to change to it.
PepiMK, can you perhaps shed any light on what will occur?
I've also experienced a great improvement in the operation of the 1.6.1.21 TeaTimer beta on my old WIndows 2000 Professional based PII 400 w/512MB RAM. It used to spike to 100% utilization for several minutes after Windows logon, but now only does this for a few seconds until TeaTimer starts checking the System process when it drops to about 3% average. I did have to disable the balloons though, since they streched out the startup process for the original several minutes even with the low utilization, though I could speed this manually by clicking them away.
Though Patrick and the Team will make the real decision, there is precedent for delivering an updated TeaTimer via the Integrated updates, including any additional files that might be required. As you mentioned, it's probably best to default to the mode that will work for everyone, leaving it to the more technically literate to modify their system for performance.
It's also common to post the technical reason and pointers to more information on the main web site, as well as include some info in the Help or Tutorials. In this case though, it might make sense to include the initial configuration in either the installer or the Widard that runs at first startup, though many make mistakes here in a rush to install, so stability should come before performance in this decision. This would also, of course, require the creation and digital signing of a new complete installation package as well.
Bitman
Nagan,
The Teatimer beta release is only a patch, not a full spybot installation. The .zip file contains a replacement Teatimer.exe file and a number of registry patch files to allow changes in configuration.
To install the teatimer beta I would recommend first unticking Teatimer in Spybot Tools/Resident, then renaming the existing Teatimer.exe in C:\Program Files\Spybot - Search & Destroy. I renamed mine OldTeatimer.exe.
After that, just copy the new Teatimer.exe into the folder and then retick it in Spybot and my preference is to then reboot.
Note: to see teatimer.exe you will need to unhide system files - don't forget to rehide them again after.
Finally: Whilst it seems fine at the moment, as with all beta releases, there is no guarantee that it is bug free - that after all is what beta is all about. If you are not comfortable with this stay with the official release versions.
greyfox, i tried what you suggested and now i will reboot and see if the new teatimer works. :) thanks. I will post back with my results!
everyone, that the new teatimer works great!! Before with the other teatimer, My system when i logged in would not load at first all my icons next to the clock, causing me to have to log out and then re-login back in so that everything loaded correctly. My startup time is 1 minute less then it used to be. Also, teatimer is using very low requirements now on my system, system specs are in my signature. I also noticed that when right clicking the old teatimer, it took a second or two before the menu popped up. I am happy to report that with the new teatimer version i am able to right click and have the menu immediately pop up. This new teatimer works beautifully.Thanks!! :) :bigthumb: :)
After deciding to try TT today after a long hiatus, the beta came just in the nick of time to help me revise my opinion of the extra layer of realtime protection. TT as packaged with v16030 popped up a whitebox with a cancel button a few minutes after a reboot, chilled the inputs, stopped the clock (sound familiar?) and ungracefully died. As did the slow and fast reg options, although they were more or less graceful. The default reg option seems just right for me (P3 @ ~1GHz, 512RAM and of course WinME)
a) TTb-off startup stats - CPU idle 0%, Userfree 99%, pm used 35%
b) 'slow' reg - medium CPU bump, pm 74% `til about 9 minutes in (TTb died)
durations were odd, pm backed down about 2 min. before TTb terminated
c) 'hi' reg - very high CPU plateau, pm 42% `til about 10 minutes in (TTb died gracefully)
the very high 99% plateau lasted about 2-3 minutes, then a 3-5% idle
d) 'default' reg - low-med CPU bump, pm 43% and *stable*
decent and reasonable performance for realtime monitoring
Possible idea for 'nervous Nellies' - blue or other neutral 'blink-light' anim on traycon to show working status of silent mode (reassuring without alarming, it does the job you trust it with).
:bigthumb: Good Deal and hope the new improved TT works for others as well
I wanted to let you know that the only issues i found, were that when allowing or denying a change, it takes 100% cpu usage, and when i click allow it takes 4 seconds to register the click. Otherwise, it works fine. You can read my above posts that i made as well. What happened to the box that appeared in the lower right hand corner when you allowed or denied a change? Or was that supposed to be shown by notification balloons? Because that option is checked in teatimer, but i have not seen any notification balloons from teatimer yet...
129260,
The accept/deny panel (see attached screen shot) comes up roughly in the middle of the display and is not affected by whether the "show info balloons" is ticked or not, that only stops the display of the Teatimer scanning process information.
I'm not sure if this is the right place to post this, but since it seems to be the primary thread to discuss Tea-Timer, so I'm going to go ahead anyway.
I came to the forums looking for a solution to Tea-Timer's increasing memory usage. I found that a new version of Spybot had been released that I was unaware of. After reading this topic (and several others), it appears that my concerns were echoed by others and that the new version would address them.
While reading the various discussions here, it appears that certain trade-offs were being made.
If I understand what has been said here, then this is the way Tea-Timer behaves. At initial startup of TT, it scans all active processes to look for problems. This scan takes much CPU and/or memory to accomplish this task. TT then goes into a quiescent state where it waits patiently for something to happen (like a new process starting, registry change, etc.) and then activates again performaing a new scan, trap, whatever, of the specific item then returning to its quiescent state again.
What I don't see explained is why TT needs so much memory when it is just waiting for something to happen. It is not the virtual memory that bothers me but the size of the memory that seems to need to remain resident. Is this something that can be improved or is it just the nature of the beast that a large physical memory footprint is required.
Thank you for a wonderful product.
Win2K, K2-450, 192mb SSD 1.5.2, TT (for now)
md usa spybot fan
2008-08-01, 18:27
snrcfan:
This thread is about problems encountered with the Spybot 1.6 version of TeaTimer (TeaTimer 1.6.0.20) and the measures taken to correct those problems including the development of a beta addition of TeaTimer (TeaTimer 1.6.0.21):
TeaTimer-beta-1.6.1.21.zip (http://www.spybotupdates.com/files/beta/TeaTimer-beta-1.6.1.21.zip)
I suggest that you upgrade to Spybot 1.6, download and install the beta version of TeaTimer and see if that has alleviated your concerns.
snrcfan:
This thread is about problems encountered with the Spybot 1.6 version of TeaTimer (TeaTimer 1.6.0.20) and the measures taken to correct those problems including the development of a beta addition of TeaTimer (TeaTimer 1.6.0.21):
TeaTimer-beta-1.6.1.21.zip (http://www.spybotupdates.com/files/beta/TeaTimer-beta-1.6.1.21.zip)
I suggest that you upgrade to Spybot 1.6, download and install the beta version of TeaTimer and see if that has alleviated your concerns.
I'm sorry if I didn't make myself clear, but I have downloaded and tried the new version(and patch). I uninstalled it after some preliminary testing due to my need to validate and test before permanent use. That was why I put "(for now)" at the end of my post. My concern was with the continued memory demand I noticed during my briief experiment. I was trying to ascertain whether or not there would be any future possibilty of reduced resident memory usage. As it is now, whenever I need to free up memory, I unload TT until the next reboot and I was hoping that the new version would not require this. The new version is a definite improvement over the old, but not enough to warrent an immediate upgrade.
As an example, could TT be split into a startup process that does the initial work and a permant/resident process that only looks for changes?
snrcfan:
This thread is about problems encountered with the Spybot 1.6 version of TeaTimer (TeaTimer 1.6.0.20) and the measures taken to correct those problems including the development of a beta addition of TeaTimer (TeaTimer 1.6.0.21):
TeaTimer-beta-1.6.1.21.zip (http://www.spybotupdates.com/files/beta/TeaTimer-beta-1.6.1.21.zip)
I suggest that you upgrade to Spybot 1.6, download and install the beta version of TeaTimer and see if that has alleviated your concerns.
I'm sorry if I didn't make myself clear, but I have downloaded and tried the new version(and patch). I uninstalled it after some preliminary testing due to my need to validate and test before permanent use. That was why I put "(for now)" at the end of my post. My concern was with the continued memory demand I noticed during my briief experiment. I was trying to ascertain whether or not there would be any future possibilty of reduced resident memory usage. As it is now, whenever I need to free up memory, I unload TT until the next reboot and I was hoping that the new version would not require this. The new version is a definite improvement over the old, but not enough to warrent an immediate upgrade.
md usa spybot fan
2008-08-01, 19:56
snrcfan:
Since memory usage of TeaTimer seems to be your concern even with TeaTimer 1.6.0.20, have you attempted to experiment with the registry tweaks included with the beta download (TeaTimer-beta-1.6.1.21.zip (http://www.spybotupdates.com/files/beta/TeaTimer-beta-1.6.1.21.zip)) to see if they alleviate your concern?
When you download TeaTimer-beta-1.6.1.21.zip (http://www.spybotupdates.com/files/beta/TeaTimer-beta-1.6.1.21.zip) and extract the files, there are three (3) .reg files that can be used to alter the memory usage of TeaTimer:
TeaTimer-scanmode_default.reg
TeaTimer-scanmode_fast_but_more_memory_req
TeaTimer-scanmode_slow.reg
Have you attempted to experiment with those registry tweaks and what were the results?
There are posts in this thread concerning those registry tweaks. Among them are:
post # 23 (http://forums.spybot.info/showpost.php?p=214671&postcount=23)
post # 24 (http://forums.spybot.info/showpost.php?p=214676&postcount=24)
post # 29 (http://forums.spybot.info/showpost.php?p=215006&postcount=29)
post # 31 (http://forums.spybot.info/showpost.php?p=215091&postcount=31)
post # 32 (http://forums.spybot.info/showpost.php?p=215311&postcount=32)
post # 36 (http://forums.spybot.info/showpost.php?p=216228&postcount=36)
…
Yes I tried all three. Fast is unusable for me (too much thrashing). I'm not saying that I can't use TT, just that it seems to need more resident memory than I would expect. I accept that the biggest limitation here is the amount of memory on my system and not TT itself, its just that as an old programmer I know that today few programs consider memory to be anything but abundant.
I know you are trying to help me, but we seem to be getting off into a diagnostic discussion. All I really need right now is to know when the new TT is intergrated into the V1.6 download so I can begin testing and validating SS&D V1.6. (No beta allowed!). The memory issue is really for the developers to consider for possible future improvements.
I thank you for your kind try at assistance but I think at this time I will end this and wait for TT to come out of beta.
129260,
The accept/deny panel (see attached screen shot) comes up roughly in the middle of the display and is not affected by whether the "show info balloons" is ticked or not, that only stops the display of the Teatimer scanning process information.
You misunderstood, :)
What i am saying is, when i allow or deny a change, the box that used to appear in the bottom right hand corner stating what action was taken on the change is now gone. Not the allow/deny change box, The box that said user decision or whitelist AFTER you had allowed/denied a change. It appeared above the clock. And i had thought that the notification balloon was to replace the small box. Hopefully everyone can understand that....Also i hope pepimk sees my other posts...and doesn't miss them.....anyway's, i didn't try the registry tweaks yet, just the debug log one, so that the log can show where any problems might lye, i just copied the new teatimer over and replaced the old one. :)
You misunderstood, :)
What i am saying is, when i allow or deny a change, the box that used to appear in the bottom right hand corner stating what action was taken on the change is now gone. Not the allow/deny change box, The box that said user decision or whitelist AFTER you had allowed/denied a change. It appeared above the clock. And i had thought that the notification balloon was to replace the small box
129260,
That is indeed what happens - after one allows or denies the change the details appear in a balloon, and this will occur even if the show info balloon is not ticked - ie that setting only applies to the scanning info balloons. Unfortunately I haven't been able to get the balloon to appear in a screen shot as yet - My old faithful screen shot utility is letting me down.
129260,
That is indeed what happens - after one allows or denies the change the details appear in a balloon, and this will occur even if the show info balloon is not ticked - ie that setting only applies to the scanning info balloons. Unfortunately I haven't been able to get the balloon to appear in a screen shot as yet - My old faithful screen shot utility is letting me down.
Glad were on the same page now haha. :) I just find it odd because i have not seen any notification or anything after i allow/deny a change....
And also: I wanted to let you know that the only issues i found, were that when allowing or denying a change, it still takes 100% cpu usage, and when i click allow it takes about 2 seconds to register the click. Otherwise, it works great! :bigthumb:
Greyfox,
ac'tivaid (http://www.heise.de/software/download/activaid/24593) is quite useful for making screenshots (and other stuff).
http://www.abload.de/thumb/teatimer_ballon_001df5.png (http://www.abload.de/image.php?img=teatimer_ballon_001df5.png)
http://www.abload.de/thumb/teatimer_ballon_0024to.png (http://www.abload.de/image.php?img=teatimer_ballon_0024to.png)
And also: I wanted to let you know that the only issues i found, were that when allowing or denying a change, it still takes 100% cpu usage, and when i click allow it takes about 2 seconds to register the click.
129260,
2 seconds after allowing appears to be a bit too long. I have rechecked this with the System Startup and I don't get any noteable lag from Teatimer after allowing/denying. But before Teatimer shows its allow/deny dialog a little time is required for checking the file added to the System Startup (thus the CPU load). Where exactly do your observation occur?
Yodama,
Thank you for the link - I have opted to go for the moment with the portable version of Activaid (En) which I have installed on a USB flashdrive I keep handy utilities on. At this stage I have only setup the screen shot option, and it works very nicely - I can even capture the bubbles now!
Edit: On my PC, the close of the allow/deny dialogue on clicking on allow is virtually instantaneous and the bubble come up almost immediately as well - the delay would be small parts of a second.
i was just about to post today, when i noticed that now it does not do it anymore........very weird. The allow/deny box was about a registry change i allowed to delete java from my startup.....in any case, now when i get the allow/deny box it does not take 2 seconds anymore. So i guess its fixed....weird but oh well....hasn't done it again yet.....
I still do not see any notification balloon or anything suggesting my change was accepted..... :scratch:
even though i know it was...
hello,
i'm new to the forum and i've been doing some upgrading to a friend's computer. it's a p2 350 with 1 gb ram and xp pro. i have noticed that tt in sb v160 runs the cpu at 100%. the system goes back to "normal" when i turn tt off.
i have v160 installed on a celeron 2.4ghz 2gb ram and a hp laptop with a 2ghz athlon 64 and 2gb ram both with xp pro and have no problem with the cpu sticking at 100%.
i have read the replies on this thread and have not found a solution. my friend is not very computer savy and i am beginning to think that disabling tt wouldn't be such a bad idea.
i certainly want them to have a good computering experience without having them making decisions about registry changes that they would know nothing about.
am i wrong in my thinking and is there a cure for this malady?
129260,
thanks for your feedback. I think we have to watch this behavior to see if it occurs again.
Did you disable the balloon tool tips within Windows? You can check this in the registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advacned
"EnableBalloonTips"=dword:00000000
This would have the tool tips disabled completely, setting the dword to 1 will reenable the balloon tips (restart of the explorer is required). By default this value is not set.
kdd53,
once the teatimer starts it will scan the running processes, this will cause a cpu load depending on how many processes are present, on an older computer like the p2@350 and WinXP this will take a while.
The current beta of the teatimer will show that it scans with a balloon tip and it will improve on scanning time through caching. This way there will be one long scan for processes but subsequent scans will be quicker.
Download:
TeaTimer-beta-1.6.1.21.zip (http://www.spybotupdates.com/files/beta/TeaTimer-beta-1.6.1.21.zip)
wyrmrider
2008-08-06, 18:41
A beta t-teimer 1.6.1 is included in today's update
Because other programs are able to give me notification balloons. such as windows defender. It doesn't do any notification balloons on my laptop ether. Same thing applies. This is weird.......cause i have never seen teatimer give me a notification balloon so far, and other programs are able to give me the notification balloons.......:scratch:
Thanks for the help yodama, feel free to ask more questions. :) Hopefully we can figure this out!
drragostea
2008-08-07, 21:25
I've attempted to download the beta updates and it was successful.
I heard there was v.1.6.0.31?
My TeaTimer is: v.1.6.1.22
The CPU usage is 0% at the moment, but it was 50% CPU during the few minutes about the installation of TeaTimer beta.
However, what concerns me is that TeaTimer is still using 43MB of memory as compared to 14MB when it was first installed.
Thoughts? :scratch:
129260,
please check these registry locations:
[HKEY_CURRENT_USER\Software\Safer Networking Limited\SpybotSnD]
"Path"="C:\\Program Files\\Spybot - Search & Destroy\"
if you installed Spybot S&D to a different directory that path need to be adjusted.
[HKEY_CURRENT_USER\Software\Safer Networking Limited\SpybotSnD\TeaTimer]
"ShowInfoBalloons"=dword:00000001
this is the setting for active balloon tips for the teatimer, this can be switched on (1) an off (0) with the context menu of the teatimer tray icon.
drragostea,
43 MB is normal for Teatimer 1.6 on a Windows XP system, when did you get 14 MB?
gagliaudo
2008-08-08, 10:36
129260,
thanks for your feedback. I think we have to watch this behavior to see if it occurs again.
Did you disable the balloon tool tips within Windows? You can check this in the registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advacned
"EnableBalloonTips"=dword:00000000
This would have the tool tips disabled completely, setting the dword to 1 will reenable the balloon tips (restart of the explorer is required). By default this value is not set.
kdd53,
once the teatimer starts it will scan the running processes, this will cause a cpu load depending on how many processes are present, on an older computer like the p2@350 and WinXP this will take a while.
The current beta of the teatimer will show that it scans with a balloon tip and it will improve on scanning time through caching. This way there will be one long scan for processes but subsequent scans will be quicker.
Download:
TeaTimer-beta-1.6.1.21.zip (http://www.spybotupdates.com/files/beta/TeaTimer-beta-1.6.1.21.zip)
Dear Yodama,
I have Spybot S&D 1.6.0.30;
my Teatimer situation is the following:
http://img126.imageshack.us/img126/1637/teatimermemorykz0.th.jpg (http://img126.imageshack.us/img126/1637/teatimermemorykz0.jpg)chrome://deimageshack/skin/is_banner.png (http://www.imageshack.us/)
Is there a way to "improve" the value related to Utilizzo della Memoria (Memory Usage)?
Maybe installing the beta version of Teatimer ?
and with what kind of configuration (what "scanmode")?
Thanks a lot for an answer !!!
Bye bye ! Paolo :red:
hello gagliaudo,
please apply one of the 2 .reg files attached to this post.
Then restart Teatimer , your memory usage for Teatimer should then be about 43 MB.
Teatimer-conserve_memory.reg
looks like this:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Safer Networking Limited\Tweaks]
"ConserveMemory"=dword:00000001
your current data is most likely "dword:00000000" which makes Teatimer a bit faster but more memory consuming.
Teatimer-scanmode_default.reg
looks like this:
[HKEY_LOCAL_MACHINE\SOFTWARE\Safer Networking Limited\Tweaks]
"ConserveMemory"=-
this removes the setting for ConserveMemory and restores the default for Teatimer which is actually conserving memory.
gagliaudo
2008-08-08, 12:23
hello gagliaudo,
please apply one of the 2 .reg files attached to this post.
Then restart Teatimer , your memory usage for Teatimer should then be about 43 MB.
Teatimer-conserve_memory.reg
looks like this:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Safer Networking Limited\Tweaks]
"ConserveMemory"=dword:00000001
your current data is most likely "dword:00000000" which makes Teatimer a bit faster but more memory consuming.
Teatimer-scanmode_default.reg
looks like this:
[HKEY_LOCAL_MACHINE\SOFTWARE\Safer Networking Limited\Tweaks]
"ConserveMemory"=-
this removes the setting for ConserveMemory and restores the default for Teatimer which is actually conserving memory.
Dear Yodama, I have applied the first reg and ... success!!! :2thumb:
Memory Usage 43.320 KB
Thanks a lot !!!
wyrmrider
2008-08-09, 00:50
Drrago good buddy
Is not your version LATER than the other you mention
did you just download a big file or something to have that large footprint?
Is it still there?
I've attempted to download the beta updates and it was successful.
I heard there was v.1.6.0.31?
My TeaTimer is: v.1.6.1.22
The CPU usage is 0% at the moment, but it was 50% CPU during the few minutes about the installation of TeaTimer beta.
However, what concerns me is that TeaTimer is still using 43MB of memory as compared to 14MB when it was first installed.
Thoughts? :scratch:
ya weird, my teatimer version is v.1.6.1.21 ?? Do i need to download the beta teatimer from this thread again? Has it been updated since i downloaded it a bit ago? Should i try using the updater within spybot to download the latest beta teatimer?
drragostea
2008-08-09, 08:43
@Yodama, I am serious. Spybot-Search&Destroy's TeaTimer usage was using 14MB at one time (which I was happy for the improvement). This situation of TeaTimer using 43MB sounds just like the same TeaTimer in v.1.5.2.20. The 14MB memory usage observation took place during the week for Spybot-SD's 1.6 release. TeaTimer rose to 28MB of memory during the first hour of usage.
If TeaTimer's memory usage (despite it's new features) was the same as it's previous version, then the statement about the the reduced memory usage (in my opinion) is false.
Edit: As for 2 hours of usage, I took a look at Task Manager (TeaTimer beta) and it was using 30MB roughly. And this is only for the beta.
dj.turkmaster
2008-08-09, 13:20
My teatimer was using very little ram too. But then I found out that after updating spybot's database and restarting the computer the new updates affected teatimer ram usage. Thats because before updating it was saying 10thousand processes blacklisted but after updating it says 148354 processes blacklisted and this naturally affects teatimer's ram usage.
If TeaTimer's memory usage (despite it's new features) was the same as it's previous version, then the statement about the the reduced memory usage (in my opinion) is false.
drragostea,
It's all a matter of how you look at it. As real time active prevention Teatimer has to keep up with the ever increasing number of problems created by the miserable lowlife that produce malware. It has to keep doing more and more, and no matter how smart the coding, sooner or later that will mean using more resources, and/or taking more time. There will be complaints if the software doesn't keep doing more, there will be complaints if it does but uses more resources, and there will be complaints if it does but is slower.
I don't know whether you took part in the beta test of the new version of Teatimer or not, but if you did, you will know that the "conserve memory" mode (which is the default in the new release) was in the area of 40Mb, and that this was and is greatly reduced from the "higher speed at the expense of more memory" which comes in at about 173MB on the three XP machines I have.
The developers of Spybot have a difficult task trying to please users with very different criteria. At one end of the spectrum there are those who for what ever reason have remained with old operating systems with very little memory, and at the other end those who have modern fast platforms with heaps of memory. To be brutally frank, over time the first catagory is gradually dying by attrition, and the latter is moving back to take their place as technology continues to go forward - thats life.
Those with modern equipment rightfully expect performance, and 173MB is really not an issue for them. For those in the middle, with lower but still reasonable amounts of memory, 40MB is also not an issue. I personally think this new version of Teatimer with its ability to be configured in the two different modes, and also with its "caching" of scan results is a real step forward in trying to meet the needs of the widest possible user group.
At the lower end of the equipment range at some stage users have to make a decision - when their equipment is no longer adequate to support the type of software that is needed in todays world, then they either have to replace it, upgrade it, or accept the fact that they can't have all the benefits and features. In this case that may be to use Spybot without Teatimer. It is worth remembering that some other software hasn't bothered to support their end of the spectrum at all.
I fully expect that many will take issue with this post - so be it.
that makes sense. I can see both sides there. Anyway's, anyone have any ideas about what i posted? Ha, I'm not trying to be a nuisance, but ya i am just wondering. :)
here (http://forums.spybot.info/showpost.php?p=220477&postcount=64) and here (http://forums.spybot.info/showpost.php?p=221284&postcount=71)
Thanks :)
129260,
It seems to me that those who were already using 1.6.0.30 did not get updated to 1.6.0.31 from the downloads - I don't know what the difference is between them. If settings were to show beta items during download Teatimer 1.6.1.22 was offered and installed.
So prior to the download I has 1.6.0.30 with Teatimer 1.6.1.21. Now I have still have 1.6.0.30 but with Teatimer 1.6.1.22.
Last night I downloaded the updates on two PC's for another user who was still using 1.5.0.20, but changed the settings (temporarily) to show betas. Those PC's are both now 1.6.0.31 and 1.6.1.22.
If you change your setting to show beta downloads you should be able to get the latest Teatimer issue - I have no idea how to force an update from 1.6.0.30 to 1.6.0.31
On your balloon problem. The taskbar Teatimer right click menu item to show (or not show) balloons only applies to the "scanning notification balloons". The other info balloons still appear. The way I use to test this quickly on XP is to go to Control panel/Display/ScreenSaver Tab. Change the Screen saver from None to Windows XP (and vice versa). This will cause the Allow Change/Deny change dialoge to come up and when Allow is clicked a ballon will come up confirming the change made as a user decision. This will occur regardless of the setting of the show info balloons.
Hope this helps
129260,
It seems to me that those who were already using 1.6.0.30 did not get updated to 1.6.0.31 from the downloads - I don't know what the difference is between them. If settings were to show beta items during download Teatimer 1.6.1.22 was offered and installed.
So prior to the download I has 1.6.0.30 with Teatimer 1.6.1.21. Now I have still have 1.6.0.30 but with Teatimer 1.6.1.22.
Last night I downloaded the updates on two PC's for another user who was still using 1.5.0.20, but changed the settings (temporarily) to show betas. Those PC's are both now 1.6.0.31 and 1.6.1.22.
If you change your setting to show beta downloads you should be able to get the latest Teatimer issue - I have no idea how to force an update from 1.6.0.30 to 1.6.0.31
On your balloon problem. The taskbar Teatimer right click menu item to show (or not show) balloons only applies to the "scanning notification balloons". The other info balloons still appear. The way I use to test this quickly on XP is to go to Control panel/Display/ScreenSaver Tab. Change the Screen saver from None to Windows XP (and vice versa). This will cause the Allow Change/Deny change dialoge to come up and when Allow is clicked a ballon will come up confirming the change made as a user decision. This will occur regardless of the setting of the show info balloons.
Hope this helps
For the help. I will try the updater on Wednesday to get the latest beta of teatimer. Maybe that will solve the second issue: But unfortunately, even with your test, (a good way to have teatimer ask a question, thanks.) I again see no indication at all that my change was accepted. This happens on 2 machines. I only see the allow/deny box. There is no hint anything is accepted or denied, i just know what is done because of what i clicked. I get no box, no balloon, nothing. Nothing indicating user decision at all. I don't even get the scanning notification balloons. Nothing. So ya, weird!! :scratch: I did install the beta teatimer per your directions by the way, maybe updating using the updater on beta mode will solve my teatimer weirdness.
drragostea
2008-08-10, 06:06
Greyfox:
I appreciate the response. No further questions, I believe TeaTimer is reasonable enough.
129260,
A question - On the PC that doesn't show information balloons, do you have more than one user account, and if so, is there any difference in the balloon situation when running from each user account, and which account were you logged in on when you installed Spybot.?
129260,
A question - On the PC that doesn't show information balloons, do you have more than one user account, and if so, is there any difference in the balloon situation when running from each user account, and which account were you logged in on when you installed Spybot.?
Um, the desktop yes. 3 accounts. 2 limited 1 admin. Laptop only has 1 admin account. I was on the admin account when installing new teatimer on both pc's. And no, there is no difference on other accounts, because teatimer is not set to run on the limited accounts. :) Thanks for the help, i think if i use the updater on beta updates i can download the newest beta teatimer and then hopefully that will fix the issues. :)
drragostea,
It's all a matter of how you look at it. As real time active prevention Teatimer has to keep up with the ever increasing number of problems created by the miserable lowlife that produce malware. It has to keep doing more and more, and no matter how smart the coding, sooner or later that will mean using more resources, and/or taking more time. There will be complaints if the software doesn't keep doing more, there will be complaints if it does but uses more resources, and there will be complaints if it does but is slower.
I don't know whether you took part in the beta test of the new version of Teatimer or not, but if you did, you will know that the "conserve memory" mode (which is the default in the new release) was in the area of 40Mb, and that this was and is greatly reduced from the "higher speed at the expense of more memory" which comes in at about 173MB on the three XP machines I have.
The developers of Spybot have a difficult task trying to please users with very different criteria. At one end of the spectrum there are those who for what ever reason have remained with old operating systems with very little memory, and at the other end those who have modern fast platforms with heaps of memory. To be brutally frank, over time the first catagory is gradually dying by attrition, and the latter is moving back to take their place as technology continues to go forward - thats life.
Those with modern equipment rightfully expect performance, and 173MB is really not an issue for them. For those in the middle, with lower but still reasonable amounts of memory, 40MB is also not an issue. I personally think this new version of Teatimer with its ability to be configured in the two different modes, and also with its "caching" of scan results is a real step forward in trying to meet the needs of the widest possible user group.
At the lower end of the equipment range at some stage users have to make a decision - when their equipment is no longer adequate to support the type of software that is needed in todays world, then they either have to replace it, upgrade it, or accept the fact that they can't have all the benefits and features. In this case that may be to use Spybot without Teatimer. It is worth remembering that some other software hasn't bothered to support their end of the spectrum at all.
I fully expect that many will take issue with this post - so be it.
May I ask how can I get the teatimer to performer at higher speed like you say??
I've been looking at my settings but couldn't find an option for increasing the speed of teatimer at the expense of higher memory. I'd like to see it for myself which option will be preferable to me. I'm using the 1.6.0.30 with teatimer beta version 1.6.1.22. Thanks in advance!
md usa spybot fan
2008-08-11, 14:25
rappie:
Currently the settings must be done via registry tweaks.
From Spybot's wiki.spybot.info site:
Registry Tweaks (http://wiki.spybot.info/index.php/Registry_Tweaks)
Usage (http://wiki.spybot.info/index.php/Registry_Tweaks#Usage)
Usage
To create such a tweak, create a registry value in the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Safer Networking Limited\Tweaks\Application.exe\
Replace Application.exe with the name of the executable it should affect, no paths used. Or, if you want the tweak to apply globally to all our products, simply use this path:
HKEY_LOCAL_MACHINE\SOFTWARE\Safer Networking Limited\Tweaks\
ConserveMemory (http://wiki.spybot.info/index.php/Registry_Tweaks#ConserveMemory)
ConserveMemory
Used by TeaTimer only currently to indicate which version of the on-access scanning engine to use.
ConserveMemory : REG_DWORD = 00000000 (less memory, starts faster, but scans slower)
ConserveMemory : REG_DWORD = 00000001 (the mode available by default in versions up to 1.6 beta 2)
By default, currently method 0 is set. Plans are to make the default choice depend on the overall system memory.
__________
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Safer Networking Limited\Tweaks]
"ConserveMemory"=dword:00000000
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Safer Networking Limited\Tweaks]
"ConserveMemory"=dword:00000001
im getting a little confused with the registry. I was able to made the registry entry HKEY_LOCAL_MACHINE\SOFTWARE\Safer Networking Limited\Tweaks\ but i don't know how I'll be able to enter the following values
ConserveMemory : REG_DWORD = 00000000
ConserveMemory : REG_DWORD = 00000001
And should I add both entries or just the one I prefer to use?
Sorry, I'm really just a novice when it comes to registry tweaks.
another thing, what I would really like is to set the memory usage of teatimer to 173mb just like what greyfox was saying.
drragostea
2008-08-12, 01:34
Hello rappie.
Yes, I believe you can set it to 1 (one) if you wish to and have the adequate resources.
pwillener
2008-08-12, 08:22
im getting a little confused with the registry. I was able to made the registry entry HKEY_LOCAL_MACHINE\SOFTWARE\Safer Networking Limited\Tweaks\ but i don't know how I'll be able to enter the following values
ConserveMemory : REG_DWORD = 00000000
ConserveMemory : REG_DWORD = 00000001
And should I add both entries or just the one I prefer to use?
Sorry, I'm really just a novice when it comes to registry tweaks.
I strongly recommend that you make a full registry backup before you start fiddling with the registry. ERUNT (http://www.larshederer.homepage.t-online.de/erunt/) is a good registry backup tool.
Right-click on the Tweaks folder, New -> DWORD Value. Rename the 'New Value #1' to 'ConserveMemory'. Right-click and Modify, then set the value to 0 or 1.
i did it. I was able to create the registry entry. The only problem is that nothing seems to have changed :sad: The teatimer is still running at the expense of 40mb and not on the faster 173mb that I am trying to do.
Thanks to those who shared their knowledge.:)
1 is the conserving one, the faster one would be 0 :)
Btw, since the balloons are quite annoying on 2000 where you can't click them away, we're looking at more possible changes now...
drragostea
2008-08-13, 20:15
1 is the conserving one, the faster one would be 0 :)
:sad: I got it mixed up. Thanks Pepi, I'll keep that in mind in the future.
1 is the conserving one, the faster one would be 0 :)
Oh I see. Thanks!:)
I mixed that up in the .reg files as well I think ;)
Well, anyway, changes for a new TeaTimer update:
Balloons completely deactivated on Windows 2000 (due to Windows 2000 fading them out only after a countdown in which the user actively uses the desktop).
"Show balloons" setting now affecting both process & registry balloons to improve consistency.
Balloons disabled by default (new installations of balloon-supported TT only).
No more balloons for each scanned process (just the start/stop ones). While that was of interest for the very curious, it was just bothersome to most (maybe I'll add a hidden tweak for debugging purposes, but no GUI way to switch).
If balloons are enabled, the "Scanning new processes..." one will have a second line of text pointing at where it can be disabled again.
This ends in even less information compared to 1.5 shown (aka less irritation) by default since registry change balloons are disabled by default as well.
md usa spybot fan
2008-08-16, 18:55
Patrick (PepiMK):
re:
...
Balloons completely deactivated on Windows 2000 (due to Windows 2000 fading them out only after a countdown in which the user actively uses the desktop).
"Show balloons" setting now affecting both process & registry balloons to improve consistency.
Balloons disabled by default (new installations of balloon-supported TT only).
...
...
....
If you intend on disabling balloons on Windows 2000, combining the control of all balloons including "registry balloons" into the "Show balloons" setting and disabling the display of balloons by default, I disagree.
TeaTimer has two (2) distinct functions:
TeaTimer Processes Monitor.
TeaTimer Registry Monitor.
Many users of TeaTimer check "Remember this decision" on registry changes not realizing it affects future registry changes and quite a few have indicated that they thought it provided a backup of registry changes. I suggest that you return the displays for registry changes to the original display methodology or at least separate the displaying of information balloons within TeaTimer into two categories.
I believe that display information for the Registry Monitor function within TeaTimer is vital. I implore you not to combine the information displays for these two entirely different functions into one "Show balloons" setting and then disable it by default.
Patrick (PepiMK):
I agree completely with md usa spybot fan about the balloons being needed for the Teatimer Registry monitor function. In normal circumstances registry changes would not occur in such a quantity that the related balloons should be considered an irritation, and it is important to know when these are being "automatically" accepted or rejected because of white or black listing.
To be frank, if these are to be discontinued because some have voiced their irritation about the balloons, I would prefer to see the notication returned to the method used in "pre balloon" versions.
Please reconsider
PS: Can your "maybe I'll add a hidden tweak for debugging purposes" be made a definite?
Oh, normal and unnormal... we just had that... nobody here complained about the process popups as well ;) Looking back through some mail history, there were quite a few who were confused by these popups, more than expected. And you may remember the stacking issue (old balloons) with some half-removed malware? Pros can always use the log to check for changes if the want.
The old balloons were something I indeed already thought about. It's needs some thought as well though... just imagine you would have balloons shown and use /verbose to have more details in the log (that "maybe" is now /verbose as a command line parameter). Scanning three dozen processes when starting TeaTimer would fill the whole screen with balloons...
Here's a preview of what's planed for Wednesday (old balloons back on W2k, ok, ok, ok... ;) ):
http://www.spybotupdates.biz/files/beta/TeaTimer.exe-1.6.2.23.zip
(link updated!)
If you want to switch from the default (Windows balloons for XP or later, old balloons for everyhting earlier), take regedit, navigate to HKEY_CURRENT_USER\Software\Safer Networking Limited\SpybotSnD\TeaTimer\, and set InfoBalloonMode (REG_DWORD) to 0 (none), 1 (old) or 2 (new), overriding the default based on the OS version.
PepiMK
In XP using InfoBalloonMode=2 invariably the confirmation of a registry change balloon is hidden behind a previous Scanning new processes balloon. What is missing is a option (mode) to have confirmation of registry change balloons (arguably of value) enabled, but the Scanning new processes balloon (arguably of doubtful value, given the active icon) disabled, which is the way the previous beta worked with the balloons turned off via the right click option.
Can this be changed, or an InfoBalloonMode=3 added which gives the display of confirmation balloons only?
Hello I Am a Newbie on this forum
I just recieved a message that a new version of teatimer is available but can't find it TeaTimer version 1.6.1.23.
Anyone know where to download this?
Having trouble with Spybot 1,6 on two PC's running at 100% by teatimer.
Both XP Pro SP2 and SP3 same result.
With regards
spybotsandra
2008-08-21, 16:59
Hello,
You will get it here (http://www.spybotupdates.biz/files/beta/TeaTimer.exe-1.6.2.23.zip).
Best regards
Sandra
Team Spybot
Thank you Sandra
I can say that after a initial 100% occupation by the new TeaTimer version 1.6.1.23. the PC stabilised at a low level and seems to run allright now.
It's running on a XP PRo with SP3
So the problem seems to be solved
With regards
In reference to an odd pre-selected update (for me anyway, perhaps for others who manually updated TT to v1.6.2.23). The momentary tooltip info is hard to capture or get further info on for me - I deselected this item last week and manually upgraded via this link (http://www.spybotupdates.biz/files/beta/TeaTimer.exe-1.6.2.23.zip) to the more recent v1.6.2.23 - it really does appear to be a falsely preselected version 'upgrade' (indeed, an earlier-for-me version 1.6.1.0 after manually downloading, extracting and examining teatimer161.exe with FileAlyzer). TT v1.6.2.23 works fine for me, like the animation :) .
Usually I trust the pre-selections to be accurate, but best to check perhaps - I have no idea if TT would have been automatically 'updated' to an older version if I hadn't unchecked the pre-selected 'update'. Oh well, all seems fine - possibly the more recent version was not detected(?) as it was a manual 'install'. Another possibility is that TT has not been checked as 'active' on the SSD/Tools/Resident page (I prefer to enable it as a 'load-on-demand' via shortcut at the moment, although it does seem to be well-behaved with the minimal default settings).
Not just an XP problem. I'm running Vista Home Premium on AMD Turion X2 with 4Gig RAM and have had to disable TT in startup because after a re-boot it takes about 10miniutes for TT to settle down from using 50% of CPU. Not to mention the Hard Drive time it's hogging (not helped being a 5400rpm laptop hard drive).
Although, I have found disabling the start-up of un-necessary 'Audio controller, Adobe Reader-Quick-starter....etc etc.....and all the other un-used crap that loads into the task bar significantly reduces the lengh of time of the TT resource hog after boot up. Takes it down to about 3 miniutes. I suppose it's got less to scan then.
I going to re-enable them one by one to see if any in particular causes the TT to hog for so long.
Well I've been using SBS&D/teatimer for about 5 years. This whole time it has consumed a little time during startup but the system settled down to about 1% utilization which was always the systemidletask. This is on an 8-core machine (i7) Last week I did a format and reinstall of winxpsp3 and all apps and find that for the first 10 minutes 1 core has 98% utilization and a second core around 15%. If I wait for around 20 minutes it cycles back and forth between 4% and 60% on one core and 2 and 10% on one of the other cores. This occurs at the refresh rate which is about 1sec and no other activity, ie. an idle machine. The CPU usage overall shows as being 4-14% allocated to teatimer and about 1% to the systemidletask. If I kill teatimer the load almost immediately drops to 1% from systemidletask with an occasional blip from my antivirus (CA) I only have the antivirus from CA, none of the functionality that might compete with SPS&D. It announces itself as V1.6.2.46.
Some of this info has been given before by others, but I have provided it all in one go in one place to make it easier to use in search of the problem. On the view functionality, I've had nothing to complain about so far, so if it stayed the same I'd be happy. Just need to get on top of this issue.
iSpyBots
2011-08-21, 02:58
Is anyone surprised that T-timer is actually doing its job?
...
you could also run System Safety Monitor, a virtual machine, Process Guard or similar
All trade offs and all approaches open to discussion
Hello Wyrmrider,
What is a "virtual machine"? I'm always interested in ways to outsmart those adware, malware, and virus guys. This virtual machine idea has really piqued my interest. Please elaborate.
Thank you!
A virtual machine is basically a small PC which you have inside your PC. An example of a virtual machine is VMware. That's a paid one, which you pay, and install on your machine. Even though it looks safe to run malware on it, etc, some malwares are designed and developed very well to break through and reach your real PC and harm it. So, it's not 100% safe, and you should know what you're doing if you're testing malware and anti-malware applications. I do these testing myself, and no malware has managed to harm my real PC yet, and I've been doing this for several years. But I know there are some malware which is built for doing these kinds of things, so be aware.
Imageek