Design philosophy for Comodo Antivirus

Thanks and I read it all with great attention and I still did not find what a standalone AV is according to Melih. Now I’m becoming quite despondent, I do not know what to do and say :‘( :’( :‘( :’(.

Peace ;D.

It most certainly will contain:

Initially we concentrated on providing the protection technologies. Now that we have succeded in this, we have started developing some very strong (almost acid-like) cleaning technologies that will be available with CIS4. You will see the power of cleaning capability of CIS4 against most difficult hard to remove malware. And yes we will also try to clean the infected files.

In my almost religious quest to find what a stanalone av really is I have gathered some datasheets as well as some user guides from the major Antivirus companies, no offense intended to anybody. I will list them in no particular order. They are the following:

McAfee:

Norton:

http://www.symantec.com/norton/antivirus

TrendMicro:

Avira:

Kaspersky:

http://downloads.kaspersky-labs.com/docs/english/kav2010_en.pdf

Eset:

http://download.eset.com/manuals/ESET_EAV4_UserGuide_ENU.pdf

Bitdefender:

F-Secure:

http://www.f-secure.com/system/fsgalleries/datasheets/fsav2010_us.pdf

AVG:

Avast:

http://download780.avast.com/files/manuals/user-manual-home-eng.pdf

Panda:

Could anyone who has a little bit of time to burn read these datasheets, userguides and HTML documents in order to tell me that all the features built into these Antiviri. Thus, after your review could you tell me whether or not these antiviri could be considered as standalone AVs. Thanks.

Peace.

uuf…

Jaki, you’re on a quest for truth. I’m with you my fellow citizen of the world.
Go onward.

Jose.

In my almost religious quest to find what a stanalone av
"what is a standalone anti-virus" Let's start by separating the 2 words: "standalone" and the other word "anti-virus"

The definition of each word below is from Wikipedia, the free encyclopedia

The word

standalone

A standalone entity is something that has no dependencies; it can “stand alone”.

The word

anti-virus

The word anti-virus
Antivirus (or anti-virus) software is used to prevent, detect, and remove malware, including computer viruses, worms, and trojan horses. Such programs may also prevent and remove adware, spyware, and other forms of malware.

So based on those 2 definitions, if you take the time and effort to combine them together ( :slight_smile: You will get your answer :stuck_out_tongue:

:BNC Peace. :BNC

Since I answered the question, can this topic be locked because this looks like flame-bait material here.

Absolutely not, I have stated that I was satisfied with CAV in it’s present form when used as part of the package. I see no need for it to be expanded to be a more feature rich AV. I just wondered what it’s direction will be in the future. There seems to be some confusion as to what that will be. I also think that the option to install CAV without the rest of CIS should be removed from the installer.

Yes I would, and, MSE does scan email and the other things, I guess Avira doesn’t, but I said some, not all, of the other products.

Also, the thread does not need to be locked, people just need to stay on topic.

I have some comments about stand-alone AVs. I used to have only a firewall and AV for security, so I depended heavily on the stand-alone AV to catch all malware that I download. I tolerated false positives (FPs) to get the improved security. Avira optimizes its AV for this type of user.

I have since learned a lot about the limitations of an AV, so now I have a HIPS too (CIS suite). I also have more experience with an inexperienced user who calls me up every time she gets AV detection for advice on what to do. Now I value most an AV without FPs, so I can safely set the AV to automatically quarantine all detections. An AV without FPs improves usability because it provides decision-free quarantine notifications, which help the user understand why something is not working, and which reduce the number of difficult-for-newbies HIPS alerts.

I disable heuristics on my real-time AV to minimize FPs for the inexperienced user who shares my PC. I enable heuristics for my manual AV to improve security since I am the only person viewing these detections. My experience with CIS 3.12 is that its integrated AV is good fit for my real-time AV needs. I use Avira instead for manual AV scanning because it supports Thunderbird mail files.

???

I would guess so and focusing on the OP question would be one sure way to stay on topic.

MSE and Avira free provide a a real time scanner and an on-demand scanner (that’s it) which are features already provided by CAV whenever part of a multi layer approach.

Whereas earlier than the feature based characterization (realtime AV, etc) in a previous clarification (above quote) it only looked a question related to detection rates of the traditional AV technology part.

Assuming that for the feature-related aspect a real-time scanner and ondemand scanner would be enough (free Avira,MSE in a quoted example) for an AV to be able to stand on its own as you originally meant it, only that tested detection rate aspect would remain pending.

As such I hope you wouldn’t mind if I ask you to rephrase the original “design philosophy” question in a way that explicitly mention a specific detection rate percentage range (which looks a property/aspect of the answer you are waiting for)

Whereas there are already comparative tests pertaining traditional AV technologies it might be reasonable of you to also point out if they do meet your criteria or if not what they lack thus describing what other criteria need to be fulfilled in a more explicit/detailed way than insofar provided (thus detailing additional properties/aspects of the answer you are waiting for)

Since you already pointed out you feel that C-traditional AV-part do not meet those criteria, if you do explicitly detail them, all it is left would supposedly be when CAV is going to fulfill them.

My question was not only about detection rates. It was more about removal capability and scanning of all incoming data. I also did not limit the scope of other products to include only free offerings, I just used some of the free ones as examples. I would also include paid products such as Norton,McAfee,Kaspersky,Trend Micro,etc.,etc.
Since Melih has stated that the goal of CAV is to be better than any AV, paid or otherwise, the comparison has to include them all.

Most users who are used to traditional AV products would reject CAV in it’s present form as a product to be used outside of the framework of CIS. I would have to agree with them, but as I have said, as part of the package, it seems to work very well.

As such it would benefit everybody to finally clarify the characteristics that made you provide them as example thus sparing anybody to take a guess about what actually are the criteria, properties/aspects of the answer you’re waiting for.

Though words appears to have failed me, that was what I would have have though to have asked you to clarify.

Guess the likes it was more about (or less about) aren’t much explicit in detailing the criteria, properties/aspects of the answer you’re waiting for, as such I hope you would take care to clarify these pending aspects in detail.

Having anybody to take a guess and wait for you to confirm or not, IMHO would obviously provide much more ambiguity to the ongoing topic and pave the way to confusion.

Since you mentioned them as example, it appeared without doubt that Avira free and MSE would be appropriate to define that “able to stand alone” AV you have been thinking about.

As such AVs that have realtime and ondemand scanners ( but not having an IM scanner, email scanner, webpage scanner, etc) would still fulfill part of the criteria implied by those “able to stand alone” AVs insofar involved in your examples.

Now what about removal capabilities?
Do you mean the traditional AV part of CAV has it?
Do you mean that has it not or in part?

If the latter is the case what’s the difference with free Avira and MSE (example you yourself used) and what characteristics you verified to determine/acknowledge such differences?

Please be kind enough to answer also the other aspects you left pending and mentioned in my previous post.

AVs can stand on their own. Since no security is perfect security; different security applications are compared against one another on quantity of misses. It is the only direct method to measure the capability of security applications. HIPS applications can be used as stand-alones, why? Is it because they miss the least? Then, you can throw the same, “what of the ones it misses?” question at HIPS softwares too. Let me say that “layered security” is not the answer, because security is not all about percentages.

If an AV attains, consistently, high score across various tests over a considerable period of time, there is no reason why - realistically speaking - an cannot watch over a system all by itself.

People who practice safe surfing seldom infect their systems; when they do, it is always through the more popular sites. In such cases, since the malware is always very well-known, the better AVs take quick time in releasing signatures for them.

So AVs can be used as stand-alone security solutions. I think the thread starter’s reasoning behind his/her question is similar to what I have said.

Thus I would see no whatsoever difficulty to have such score, among other aspects left pending, explicitly mentioned as it indeed appeared one of the implied characteristics of “able to stand alone” AV in the opening post.

This in addition to the cleaning capabilities, which turned out to be another characteristics implied in the OP question

Obviously this topic would have been less confusing if the OP question was among the likes of is CAV Design philosophy to reach x% detection?

I do not have to clarify anything to you. If you can’t understand it by now, that’s your problem.

Whenever “able to stand alone” was used to purport a set of characteristic you never detailed, there has been nothing else to understand other than you feel that CAV do not fulfill those (seemingly difficult to describe) criteria.

Phrasing it as a question about “Design philosophy” is by far a pretty roundabout way to ask if/when CAV is going to match your expectation for an “able to stand alone” AV

It doesn’t look anybody would able to answer such a question other than yourself so I assume you’ll be (at least) kind enough to let everybody know on each forthcoming release whereas CAV will be “able to stand alone” or not.

Nevertheless I would have never expected, after asking you to extend and further define your viewpoint, to see you evade such chance.

Apparently you haven’t been the only one whose question have been left unanswered even though I did take care to define what I have been asking about.

I don’t care if it ever becomes a standalone product or not since I will always use the full product. Therefore, I have no expectations. I simply said that at the present time, CAV does not stack up well against other AV’s when used outside of the full suite (which is a known fact) and I also said that the option to use it that way should not exist. If the promised improvements to CAV come to fruition, i.e. greatly enhanced removal abilities for one, I will be very pleased, but I doubt that my position about it being used outside of the suite will change. I guess you could say my preference for it’s direction is NOT to become a standalone solution. I want it to stay as streamlined and lightweight as possible.

That does not answer my questions.

I asked you details acknowledging your examples (eg MSE).

Each person might have different viewpoint about one the others AV you used as example and post in other forums claiming that X AV “do not stack up well against other AVs”

I would expect those to provide something more than “it is known fact” when asked for details.

As such your refusal left me confused even more if I have to put such effort when I’m actually asking you to detail what criteria you assumed/deemed an AV need to be “able to stand alone”

Whereas you asked something the likes of if “Design philosophy” for Comodo Antivirus is to make it “be able to stand alone” or not.

I’m not providing details that should be self evident.

I’ll give you the reason why I made this thread. On the forums of another AV product, CAV was being attacked as being useless and terrible because it doesn’t scan things like email and web pages. I defended CAV by saying that in my opinion, CAV didn’t need to do those things within the framework of the entire suite and that it’s main function was to enhance the usability of CIS while providing basic AV protection which is all that is needed when coupled with the firewall and D+. I said that it functioned very well within the suite and it seemed to me that was the direction the developers were going with it. I got jumped on and called a Comodo drone and things like that. They said I was making excuses for the terrible product that CAV was. I made this thread to ask the developers if I was right or if they had bigger plans. So far, they have not fully answered my question but I have seen some indications that I was right in my impression of where CAV is headed and I fully support that if it is the case.

I was only looking for ammunition to defend Comodo with, not to fire at them.

What is being self evident is that you are not willing to provide details.

Though it looks that asking about what you heard on the forum of another AV would probably have you to provide some more details.

Let be it.

Nevertheless, by acting as a speech-person for other people from the beginning till now, it now appear that appropriate answer was actually something unlikely to wait for.

Hearsay can be only spread around, nobody can actually answer them even more if not detailed in a unambiguous and clear way.

IMHO It is not about ammunitions but about characteristics that can be met or not.

Once the characteristics are known/detailed the substance of the argument is defined.

I suppose you might have heard in other forum, for example, that x standalone AV got Instant messaging scanner and they see it as an important feature.

CAV has no IM scanner. That indeed is self evident. Once stated/pointed out, anybody can see if such criteria is met or not at any time (without waiting for anybody else to check that for them and rephrase it in other ways)

Indeed it is likely that those who deem an IM scanner useful would ask if CAV is going to support it. Though obviously not everybody would.

Whereas as long a person on another forum think that an IM scanner is something s/he need, s/he won’t deem any AV without it able to stand on his/her PC.

Is there something else you heard that could be detailed as unambiguous and verifiable criteria and it is not vague as the likes of “not enough” and thus address the aspects left pending?