[cmeisenzahl]

http://www.clamxav.com/

Assuming that one determines it's worth running AV software on OS X (an entirely separate discussion I think), is Clam X AV worth the trouble? Does it really work as well as commercial tools?

Thanks in advance!

Chris

[philm]

I think this program can identify and isolate 'infected' files, but cannot repair them.

[cmeisenzahl]

Originally Posted by philm

I think this program can identify and isolate 'infected' files, but cannot repair them.

Thanks very much!

[JKT]

I can't comment on whether it is particularly great or not but it uses very little resources and is easy to use. It's free, it doesn't suck up CPU when idle and will be better than using nothing. You can set it to monitor different folders (e.g. your downloads folder). However, what it lacks that the commercial anti-virus software have is heuristics - the ability to detect malware-like activity before the virus signatures have been updated. That is, ClamXav can only find viruses it already knows about, not ones it doesn't know about.

[TETENAL]

I don't think anything can "repair" infected files. They all just delete.

Anyway, the problem with ClamXav is that it doesn't monitor your computer in the background for infections. It only scans your disks when you tell it to do so. Assuming there would be a nasty virus or trojan that does some serious damage, than having ClamXav installed wouldn't protect you from running the virus or trojan. You might detect it the next time you run a ClamXav scan, but considering the current only Mac OS X virus launches Terminal you will detect the infection yourself anyway.

The commercial virus products monitor your computer all the time and immediately detect infection even before the virus is run. The downside is that this is using some processing time all the time.

[JKT]

Er, that just isn't true - ClamXav can monitor and scan target folders for changes and detect malware:

ClamXav 1.0 now has the ability to watch specified folders for newly added items and scan them as they arrive. You will be alerted to any viruses contained therein by an error message on your screen.

To tell ClamXav Sentry what to watch, drag folders into the list of items to watch. Folders may be removed from the list by first selecting its name and then pressing the "Remove Selection" button. Alternatively, the list may be emptied by pressing the "Remove All" button

If you wanted to, you could add your entire home folder for monitoring.

[rickey939]

I think it is an awesome program to say the least.

[philm]

Originally Posted by TETENAL

I don't think anything can "repair" infected files. They all just delete.

We have a Word macro virus/trojan/worm or whatever it is that crops up on our network now and again. Norton Antivirus strips it out of the file and 'repairs' it in that sense.

[barney ntd]

Originally Posted by JKT

However, what it lacks that the commercial anti-virus software have is heuristics - the ability to detect malware-like activity before the virus signatures have been updated.

Heuristics are always built by looking at a large number of existing examples. Since there are so few bits MacOS X malware so far, this means that any AV software claiming to use heuristics has based them on PC malware. However, the low-level workings of Windows and MacOS X are so different that any malware must work in a completely different way. Therefore the heuristics currently used are extremely unlikely to give you any protection at all (except against passing things on to PCs).

Barney.