I ran across an outfit on the Web that does comparative testing of antivirus software. They claim they have tested ClamAV but can't release the results because they don't have permission from the developers.

I would like to know how ClamWin (and by default ClamAV) compares to the commercial antivirus products. The results for some of them don't look too good--like Norton. How about it ClamWin team?

The comparative testing outfit is located at: www.av-comparatives.org.

Regards,

For what I know, ClamAV has from now on given AV Comparatives permission to publish the test results.

The test results is supposed to be published in a few months, if I understand IBK correctly.

Read more: http://forums.clamwin.com/viewtopic.php?t=291

That's interesting. In addition to saying that he didn't have permission from the ClamAV developer to test, the administrator also said that he had actually gone ahead and tested ClamAV but that the commercial antivirus vendors had asked him not to show ClamAV test results. Something doesn't add up!

Could it be the commercial developers are scared of a free AV product that works well in the real world? I know that Clam updates its signatures more frequently than all but a few of them, and I think it would make a good showing in a practical test featuring "in the wild" viruses, not considering scanning time.

Regards,

bull-sit. Clam retired the written permission to test and publish the results of their product due various reasons - so I will not test it. ClamWin was willing to, but ClamAV which made the engine not: and if ClamAV does not accept, ClamWin also does not, because they base their decision on what the engine developer says (which is usual).

Then why were you inconsistent in your explanation at the Web site as to why no Clam results were displayed? I read two different explanations--no permission from Clam and a request from commercial AV people not to show them. Your answer doesn't mention anything about those commercial AV people that asked you to not show the Clam results. I just can't see why you would test something but not show the results.

I have frequently found that people who use bullshit attacks have something to hide!

Regards,

can you please show me where i say anything about commercial etc.? i can not remember of such a reason (which does not make sense for me) maybe when you show me it I can tell you if something was maybe misunderstood.
i do not think that anyone from the other vendors can prohibite me to test someone else. ClamWin was invited to take part in the special test where products with low scores can particpate, but the permission was refused by clamav shortly before publication, so no results of it in the report. Should they change opinion, I can add their results to that report and update it.

Hmm.. Have I got this right?

First ClamAV gave you permission to test their product. But they didn't like the results so you wasn't allowed to publish it. Later on they changed their mind and you was allowed to publish the results. Then they changed their mind again and now you aren't allowed to publish the results.

Have I understood the situation correctly?

Sounds weird.

in reality it was much simplier i think. I hope i remember fine in what i write next:
ClamAV said it is ok if I test ClamWin but explain that ClamWin is not that good (or something similar) as the original ClamAV. ClamWin wanted to get tested by av-c, but only if ClamAV team gives the permission. One person from ClamAV wrote a mail to me saying that testing ClamWin would be not a good idea, as it would not score good against our test-sets etc. ClamWin send a written permission that allows me to test them, but with the premiss that it is only valid if ClamAV also agrees. Then when report was nearly done, and told to ClamAV and ClamWin about that i tested ClamWin, ClamAV said they do not want that their engine in ClamWin gets tested or results published, so ClamWin retired the permission (but ClamWin team was friendly and I think ClamWin would also have participated even if results are unfavorable for it). That's why you still do not see results of ClamWin on the website. But I have the results of that test somewhere already, so should Clamxx change opinion and tell me i can publish the results, I would do that.
I would need to search and check the email correspondence to be more exact/detailed, what i do not have time for (and what i do not consider important yet).

http://www.av-comparatives.org/seiten/ergebnisse/june2006test.pdf

Okay. You mentioned other companies had requested you not show the results of ClamAV testing in your forum. Below is the Web page with your answer to a question by MK637 as to why you didn't show the results. Comments?

http://www.av-comparatives.org/forum/viewtopic.php?t=247

Regards,

yeah, like i tought, a misunderstanding (due my english):
"Until some weeks ago the results were still available on the website, but they had to be removed on request of some other companies."

I was refering (31 Oct 2005) about the table with the reached levels in which i included some of the most requested products (e.g. ClamWin, and other vendors that i will not mention etc.). They were online for some time, but they had to be removed on reuqest of some other companies. With some other companies I mean 'other companies than ClamWin', and that some of those others saw that their own product scores bad and asked to remove that table from the website or I will get sued. So, to do not fall in the risk to get sued, from that moment I only show test results of products which vendors allows me to test and publish them, and do not waste time in testing other products for free if in the last moment they say 'you are not allowed to publish the results'.
Like I said, should I ever get from Clam a valid written permission to test ClamWin and to publish the results (even if they are quite low against large test-sets, lets say just for example 51% in total), I would do that. They would still be much better than just for example some other commercial products like QuickHeal, Comodo, ViruScape, etc.
Anyway, ClamAV is mainly used as mail server av, in which clamav is good to use as second scanner (is used in most universities i know in austria).

Then I guess we were both correct--eh?

You provide a useful service. Please keep it independent and don't be influenced by any of the antivirus vendors. Of course you have to "go by the book" and do things correctly--get valid permission, be objective, etc.

Clam/ClamWin is just about the most consistent antivirus software I've seen in the speed and frequency with which it gets its antivirus signatures updated and out to users. It might not find many "laboratory" viruses in a test, but I believe its signatures are for real-world/in-the-wild viruses because of the number of email administrators using it and submitting viruses they encounter. Clam also receives some submissions of viruses from other sources.

I think Clam/ClamWin would stand up pretty well against most antivirus software in recognizing viruses that are likely to be encountered. It is slow in scanning speed, but I'm sure they will optimize that over time. When they set it up for realtime/on-access scanning, it should take some business away from the commercial antivirus software.

Regards,

yeah .
but imo it is not that slow in scanning speed.
i think it is ok to use it as backup-scanner and/or email scanner.

Well, there are a lot of email shops using ClamWin, and some of them are large. It appears that they use other scanners too. That's what I'm doing, but as soon as ClamWin goes resident, I'm dropping AVG and going with ClamWin and a behavior blocker.

Why don't you have a go at that new Microsoft antivirus/security service?

Regards,

will do starting from 2007.