I’ve been using CFP 3 and Comodo Memory Firewall with Avira AV Premium for about 4 months. I am considering dropping Avira and installing the full CIS. I am wondering whether the CAVS component has these features of Avira:
Update signatures only at boot up (I use Scheduled Tasks to do this with Avira)
Configure on-access scanner for only disk reads (less resource overhead than disk read and write)
On-access scanner automatically ignores Mozilla Thunderbird mail files (which are huge and change a lot)
1- No, but you can have it automatically update the virus DB prior to running a scan.
2- Sort of. Compressed archives (.zip, .rar) are scanned on access (read) and not when they are written to disk.
3- Again, sort of… Currently, the exclusion list doesn’t work as you would expect. You can select files/folders to be excluded from a scan, but CIS will still scan them. It will merely suppress any detection alerts that occur. So you aren’t really excluding anything… You can however limit the scans by file size. Any file over a certain size will not be scanned.
I am confused now because this info disagrees with the previous responses to my question. In case CIS behavior changed since December 15th, I am only interested the behavior of the latest version of CIS.
As for when files are scanned, I’m just going by some recent testing I did by downloading the four Eicar fake virus test files. (This is with version 3.8)
The first two files aren’t in a compressed archive, the second two are. CIS picks up the first two files directly after download, the second two are only picked up when I attempt to access the archive.
By this I conclude that the first two files must have been scanned prior to writing, as I hadn’t yet tried to access them. Yet the compressed archives were only scanned on access.
Thanks for taking the time to answer my help requests. Looks like the forum converted your “version 3.8)” to a smiley. I had to check the box “Don’t use smileys” in my reply to get the string to display correctly, which could be helpful for others reading this topic.
I agree with your conclusion that CIS is scanning uncompressed files on write. Thanks for documenting your test cases, which can be duplicated by others in case there is disagreement about CIS behavior.
I submitted wishlist items for features 1 & 3, and I will submit for feature 2 if someone could kindly confirm that CIS v3.8 does not give the user the option for on-access scans on disk reads only. I would like to support Comodo in producing the best AV on the market.
As shown in the screenshot, it says it’s scanning on access. However, like I mentioned, the fact that the two uncompressed Eicar files are picked up without attempting access leads me to believe it’s doing writes as well. At least with certain file types.