--On Thursday, February 21, 2008 11:31:02 +0100 "Faas M. Mathiasen"
<faas.m.mathiasen (at) googlemail (dot) com [email concealed]> wrote:

> Dear Valdis,
>
> Interesting, have you compared your results with another scanner ? If
> you just scan with ClamAV
> you can't obviously really tell what you missed that other scanners found.
>

We once did a side by side test at our mail gateway using McAfee, ClamAV and
Sophos. All three scanners were automatically updated (checked for updates and
installed them if found) every hour. All three scanners got the exact same
mail stream (in other words, no one scanner saw anything or didn't see anything
that the other scanners saw).

The results were (from memory) something like 99.1% detection rate for McAfee,
98.9% for ClamAV and 87.6% for Sophos. Occasionally there would a virus that
McAfee caught that ClamAV did not, and vice versa. There was never anything
that only Sophos caught.

That test was three or four years ago, so it's meaningless now except for the
datapoint that you can trust ClamAV just as much as you trust McAfee.
Unfortunately AV-comparatives doesn't test ClamAV or Sophos, so they don't have
any recent side by side results for them. (Popular magazine tests are just
about useless.)

--
Paul Schmehl (pauls (at) utdallas (dot) edu [email concealed])
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

[ reply ]