Virus scanners

[erikguy]

I had a couple of questions about 2 AVs in particular. Can anyone tell me anything about RAV? I, in my many travels around the net, have not heard many opinions about this one and by that I mean none. I know that the fact that M$ bought it doesn't mean anything and that its huge database (108,000) only closely matched by KAV doesn't necessarily mean anything either. I'm looking for more technical facts rather than just opinions based on the UI or someone's bad experience with their support.

And what about this ClamAV? Can we really trust the effectiveness of a free AV based on the efforts of volunteers? I know that question is a little shaky seeing as how one of the best anti-spyware applications (Spybot - Search and Destroy) is built under similar circumstances. But still a valid question nonetheless. Any experts out there know how good Clam really is?

Thanks for your attention to my Qs
erikguy

[bellgamin]

{QUOTE-> And what about this ClamAV? <-QUOTE}
First off, since you asked about RAV, I assume you are seeking information about AV's for Windows. If so, ClamAV is a Linux application, not for Windows.

The Windows version of ClamAV is called ClamWin. It is presently in very early beta status.

ClamWin uses the ClamAV scanner-engine & signatures. However, it does not as yet have any Real Time Monitor {RTM}. Thus, ClamWin presently is useful for on-demand scans only. The producers of ClamWin are now working on implementing an RTM for ClamWin.

As to ClamWin's effectiveness, it is basically equal to the effectiveness of ClamAV for the reason that it uses the same signatures & a cross-platform implementation of the same engine. Its effectiveness runs about 45%. Firefighter is one of those who periodically includes ClamWin in tests of AVs. Do a search on his name & you will find his data. Or (hopefully) he will post here himself.

Bottom Line- I personally support ClamWin & Sourceforge.net with occasional $ donations. I also belong to their forum at HERE (http://sourceforge.net/forum/forum.php?forum_id=363173) so as to keep tabs on how they are doing.

At this time, however, ClamWin is *not quite ready for prime-time* IMHO.

[RejZoR]

If you wanna go for free stuff,check avast! and AntiVir. They both offer very high level of detection and low memory usage. They can be easily compared with commercial antiviruses.
ClamAV is a better choice for Unix based sistems,because Windows version is still too limited (On-Demand only).

[Blackcat]

{QUOTE-> Can anyone tell me anything about RAV? I, in my many travels around the net, have not heard many opinions about this one and by that I mean none. I know that the fact that M$ bought it doesn't mean anything and that its huge database (108,000) only closely matched by KAV doesn't necessarily mean anything either. I'm looking for more technical facts rather than just opinions based on the UI or someone's bad experience with their support. <-QUOTE}
Well you probably know that it is no longer commercially available as a standalone AV. Product registration ceased on December 12th, 2003. However, definitions are still available for the double-engined AVK Pro, which uses both KAV and RAV as it virus engines; http://www.boomerangsoftware.com/

Despite relatively poor results over at Virus Bulletin; http://www.virusbtn.com/vb100/archives/products.xml?rav.xml IMO, detection is better than this and is still top notch; http://www.av-comparatives.org/

When I used the program, once the default settings of the RTM was tweaked, it had no discernible effect on system performance and the on-demand scan speed was very fast, despite the good unpacking engine. A real pity that it was taken over as it was developing into a very good AV, comparable to the big boys in the AV field.

AVK Pro is a lot more hungry on system resources, but if you use only the RAV RTM it has a fairly light footprint. Obviously a huge database, with the combined RAV and KAV definitions, even though there must be some overlap between them. Support for this AV can be very patchy.

Some relevant threads are here; http://www.wilderssecurity.com/showthread.php?t=33597&highlight=AVKPro
http://www.wilderssecurity.com/showthread.php?t=46356&highlight=Extendia
http://www.wilderssecurity.com/showthread.php?t=43428&highlight=Extendia
http://www.wilderssecurity.com/showthread.php?t=34229&highlight=Extendia

[rdsu]

{QUOTE-> If you wanna go for free stuff,check avast! and AntiVir. They both offer very high level of detection and low memory usage. They can be easily compared with commercial antiviruses.
ClamAV is a better choice for Unix based sistems,because Windows version is still too limited (On-Demand only). <-QUOTE}
avast! -> low memory usage!?

avast! is one of the AV's that uses more memory!
But is lite on CPU recources...

[RejZoR]

Nope,AntiVir and avast! use nearly the same resources on my machine as NOD32 (we all know that NOD32 has a very low memory usage) after one day (or even more) of running. Its no different after one hour. They all use around 15MB and thats it. This number is totaly normal.

[rdsu]

At windows start, avast! takes about +/-40MB or more, and NOD32 +/-20MB...

[RejZoR]

? What are you doing!? 40MB?

3MB for ashDisp
13MB for ashServ
3 MB for ashMaiSv
300KB for ashUpdSv

This is how it looks on my machine.

[bellgamin]

I trialed Avast fairly recently. It used 19.7MB of ram on my WinME machine. Not bad a'tall a'tall.. It's on my short list for a *next AV* -- if/when I become disenchanted with what is now on my box.

[rdsu]

{QUOTE-> ? What are you doing!? 40MB? <-QUOTE}
Nothing...

[no13]

err... since we're talking about free AVs... umm...
'nother thread. http://www.wilderssecurity.com/showpost.php?p=312075&postcount=11
umm, sorry, but I've posted this at a lotta places now, and every time, its some new discussion about free AVs with entirely new people asking about the same AVs... and I have the same suggestion mostly.
err, sorry for being so useless.

[meneer]

I'm a Clamav and Avast user. And very pleased with the combination. Clamav runs on my sme server (linux). Last year and a half (or so) clam only missed one worm (plexus) in several disguises. Everything else (except of course encrypted worm attachments) is caught.
Avast caught plexus, so I'm one happy user.

Since Avast 4.5 configuring mail clients (I use The Bat!) is no longer needed. Great change!

[erikguy]

Actually I didn't know that it was no longer available, thanks BlackCat! In which case I do think I got my questions answered. Thanks everyone!

[Artras]

And what are you people using to check the memory usage? Let me guess, taskmanager. NEVER use taskmanager to see how much memory something is using, it is NOT reporting the correct amount.

[RejZoR]

Yes it does. Add VM Memory column which is hidden by default. With these two you can see how much memory it really use.

[rdsu]

I talked about the peak values of avast....

After some minutes the value is about the same as RejZoR...

I use Process Explorer to see this.

[nod32_9]

Let's take a look at Firefox...

Memory Usage...57MB
Peak Memory Usage...65MB
VB Memory Size...46MB

So the actual current physical memory load is 11MB (57MB - 46MB)?

[rdsu]

{QUOTE-> Let's take a look at Firefox...

Memory Usage...57MB
Peak Memory Usage...65MB
VB Memory Size...46MB

So the actual current physical memory load is 11MB (57MB - 46MB)? <-QUOTE}
What means VB?

In Process Explorer, the actual memory used is the "Working Set"...

[nod32_9]

Typo...should be VM...virtual memory or pagefile memory.

[erikguy]

So Artras, what do you recommend for viewing resource usage and I'll tell you right now, I'm not paying for an app just to view my CPU/RAM usage.

[Infinity]

Hi Eric, for me, process explorer is doing a great job (sysinternals)

[BlueZannetti]

{QUOTE-> Hi Eric, for me, process explorer is doing a great job (sysinternals) <-QUOTE}
I can verify that also. Great little application. Here's (http://www.sysinternals.com/ntw2k/freeware/procexp.shtml) a quick link to it.

Blue

[Technodrome]

Yup, I've been using it too and I love it.


tECHNODROME