Good evening,

I have been using ClamWin with pleasure for several years, as I find it very reliable and accurate (not 100% but still better than Microsoft's Defender ...). 1_ For some days, however, ClamWin has found me some files colored red but towards the end of the wording it gives me 0 FOUND. What does it mean ? If I go to the quarantine folder I do not find the offending file but only a text file. Is it a false positive? 2 _ In the past Clam Win also reported me blue files, what does it mean when they are blue? Thank you.

After the scan it turned from red to blue indicating a false positive... But it's strange, usually ClamWin is more accurate in false positives... https://ibb.co/0cs3Q8F

I think blue files are those that are protected system files that ClamWin will not quarantine. If it quarantined them, you would lose access to your Windows system/computer. Any detections of them are usually false positives anyway.

On the other hand, red files are not good. They are probably (not sure) detections of a virus by a ClamWin signature. Do not quarantine them yet--find out where the file(s) are located and upload them (one at a time) to Virus Total, which will check a file with abut 60 or so other antivirus programs, including Clam Av, which furnishes its scan engine and signature database to ClamWin. If a file is detected by several Virus Total AVs, you can run another ClamWin scan and quarantine it. I like to see at least 2 of these AVs detect something before I believe it: Avira (AntiVir), Bit Defender, Eset (Node32), Kaspersky, and Sophos.

Set ClamWin's quarantine option to Report--not to Remove or Quarantine. Only quarantine a file if it has been detected by Virus Total as explained above.

Microsoft Defender is a much better antivirus than ClamWin. Defender scans in realtime, while ClamWin only scans when you demand it via a manual or scheduled scan. Defender is backed by a paid professional antivirus team, while ClamWin now has has a team of 3 people who donate their time to the project. Defender has an ongoing improvement effort, while ClamWin development has stopped, and it is in the process of winding down and essentially quitting. In addition, the ClamWin virus signatures received from the Clam AV project are not nearly enough and are not as good of a quality as the signatures of Defender and many other antiviruses. The 2 ClamWin developers have always recommended that you use ClamWin as a backup to a good realtime antivirus like Microsoft Defender.

Regards,

Ok, thank you very much, I am a bit saddened by this news, because I have always found ClamWin much less invasive and cumbersome than the current Defender. Defender, in Windows 11, has become something incomprehensible, there are many technical functions it has (it seems almost necessary to take a computer course to understand it ...). Back then I preferred the Security Essential which at least was much easier to manage ... Greetings.

The current Defender then still has malfunctions. For example, it detects far more false positives than ClamWin. Custom scanning of a folder (or multiple folders) or files sometimes (or even often) crashes for no apparent reason. It detects suspected viruses, inside compressed folders, but does not remove them. The insistence on requesting the sending of suspicious files to Microsoft violates any user's privacy ... In short, I would say that the conditions for moderating Defender are all there ... Lastly, the impossibility of uninstalling Defender that does not give any real democracy in being able to choose your own antivirus (same for the Browser Edge ...).

I use a Linux computer perrsonally, but my wife's computer is Microsoft's Defender--the latest version of Windows Defender, and I have not seen any problems with it. I think it is the best Windows AV currently.

If you want to install another AV, exclude drive C from Defender scans, and also exclude any other drives you have on your computer. This will essentially disable Defender and let you use any other AV. You can also install one of the other major AVs, and Defender will disable itself as long as you use the other AV.

I don't really like what Microsoft is doing to Defender--it seems the extra security it has is devoted to business and other paying customers, but I still think it is the easiest AV to use, and it is free.


Regards.