[clamav-users] Why are the ClamAV team so slow at creating signatures ?

Paul Smith paul at pscs.co.uk
Mon Oct 6 10:54:30 EDT 2014

On 06/10/2014 15:21, Tim Smith wrote:
>> but call paid prebuildt software always better is not correct, but mostly just marketing
> What rubbish... ClamAV always lags behind the commercial vendors in
> any comparative you wish to mention.
Not if I want to make my own signatures...

It also beats the others on price and (IMHO) usability.

>> What other av product can you make your own virus signatures with, not usefull,  hmm
> You don't need to when they've got a decent set of analysts who are on
> the ball and push out new definitions quickly !
Yes you do.

We have AVG, Avira, Sophos and ClamAV.

Yes, AVG, Avira and Sophos will release virus definition updates before 
ClamAV. But usually by the time even Sophos have released their updates 
we've already received a few thousand copies of the virus.

With ClamAV we can beat Sophos by adding our own definitions, so we can 
beat even the fastest AV vendors by a few hours (that's not knocking 
them, we have different requirements from them, so we can knock together 
a simple signature test and if we cause false positives, it's our 
problem. We're not going to have zillions of other people complaining 
and be on news channels because we broke something).

> Seriously, why should I mess around with creating virus signatures,
> its a waste of my time.
OK. That's a valid choice, in which case YOU will probably be better off 
spending money on a commercial product.  For other people, the few 
seconds to generate a signature is worth the many thousands of pounds 
savings they'll make from not using a commercial product. Neither is 
wrong, just different priorities.


Paul Smith Computer Services
Tel: 01484 855800
Vat No: GB 685 6987 53

Sign up for news & updates at http://www.pscs.co.uk/go/subscribe

More information about the clamav-users mailing list