Hi ngolian, welcome to the forum
The best thing I can do is to point you at a post from Kevin :
... but best way to explain it is that antiviruses are designed to work at the FILE level ... better antiviruses can examine files more deeply, have perhaps an "emulator" or other "heuristics" that may or may not help, but in the end EVERY AV (even ours) does its thing by stopping a file from loading, and then examining it in hopes of matching a signature of some sort TO that file before it is allowed to be loaded/run.
BOClean was always designed on a philosophy of "you already HAVE an antivirus" ... if the FILE wasn't detected as harmful, then BOClean will sit there like a bouncer inside the lobby and whatever gets past the front door is OURS. We do a MEMORY scan of a process which has already loaded and begun to execute. Once it's actually started up, all of those obfuscations at the file level are no longer in use since a computer can ONLY execute a valid program. And to BE valid, any obfuscations must be completely disarmed by the program to allow it to run. So BOClean goes in at THAT level and gives anything which runs a "second opinion." And yes, we also check associated files and connections after the fact as well ... in case the AV misses it. That was ALWAYS the purpose of BOClean, and why it's proven so useful for over ten years now.
From here :
http://forums.comodo.com/comodo_boclean_antimalware/why_use_boclean-t22796.0.html;msg160516#msg160516If you have still questions, feel free to ask them
Greetz, Red.
Author