ClamWin 0.95.3 review

ClamWin provides a Windows front-end to the open source ClamAV scanning engine. It's an unpretentious application, as the bare UI and modest version number suggest, and even by the standards of free security software it's unambitious. It doesn't even offer active file protection: if you come across a suspect file you'll have to right-click and scan it manually, or wait for a scheduled sweep to pick it up.

This makes ClamWin useless against drive-by downloads, where malware is downloaded to your PC without your knowledge. In our tests the software sat blithely by as numerous pages installed and ran whatever malicious code they liked.

There's no sort of firewall either, so our network attacks went ahead without the software raising a murmur. Email and phishing attacks were equally unhindered: with no active protection, ClamWin could do nothing to stop us extracting dangerous attachments from our inbox and running them.

We do realise that some people won't brook any sort of interruption to their computing experience, and to such users ClamWin's passive approach will surely appeal.

And with almost no resident components, it's a very light installation: the total system startup time of 27 seconds with the software installed was excellent, and the 544MB system footprint was lower than we've seen with any other package.

Unfortunately, however unobtrusive ClamWin may be, we can't recommend it for the simple reason that it's useless at detecting viruses. In our recent Labs it missed an amazing 55 samples that were picked up by every one of the other 14 packages on test. And there's no behavioural analysis or reputation checking to take up the slack.

It's a shame, because the idea of a very light, open source AV engine sounds attractive. Sadly, it appears a community project like this simply can't keep up with the fast-moving world of online threats.

Author: Darien Graham-Smith