Malwarebytes vs ClamXav

[MikeHarrison]

Is anyone able to spell out the feature differences between Malwarebytes and ClamXav. Specifically, what types of things each one scans for and protects against; what locations (drives, volumes, folders, etc) they scan; any user options and, most importantly, whether the two apps are compatible with each other and can run simultaneously and safely in the background.

Thanks.

[alvarnell]

Let me start with the last question. I've always used both ClamXAV and Malwarebytes for Mac (to include the earlier apps that it's based upon) without issue as long as only one of them has background scanning (Real-Time or Sentry) enabled. I have seen issues if both are attempting to access the same new or changed file simultaneously, but your experience could be different. I frequently collaborate with both developers and have been somewhat involved with the design and testing of both apps for many years now. 

As far as features are concerned, both web sites seem to adequately explain such features so that you can compare them for yourself and they both have trial versions which will tell you exactly what their user options are.

They are basically looking for the same malware types so you won't find a lot of differences there.

ClamXAV allows for a daily schedule scan which Malwarebytes has not added yet.

Both do quick scanning of selected areas where malware is known to exist, but ClamXAV v3 that just came out yesterday now does this for the entire hard drive.

Malwarebytes scans take fare less time to do a manual scan because it isn't looking at every file on your hard drive that it can read the way ClamXAV does.

ClamXAV does check for Windows and Linux malware if that's important to you, but if you are running Windows on your Mac it's best to install Windows malware software in that partition or VM for accurate results.

I don't believe either scans incoming e-mail, but there are currently no threats to macOS from simply reading an e-mail. You would have to click on a link or open an attachment for anything bad to happen and there are other means of preventing harm from doing that.

[MikeHarrison]

Many thanks, Alvarnell. You've been extremely helpful, and I appreciate you taking the time.

[treed]

One note: Malwarebytes for Mac 3.4, which was just released last week and is still being rolled out at a metered pace, now has scheduled scanning.  

[BDonTJ]

Hi

Can YOU answer the question posed here in the ASC forum?

 

https://discussions.apple.com/thread/8357144?answerId=33287027022&page=1

 

The developer of ClamXAV, Mark Allan, does not, apparently, frequent the Apple Support Communities forums at all - yet, like Mr Thomas Reed, is supposed to be an Apple man.

 

There are LOTS of posts there by Thomas Reed - NONE by Mark Allan.  I find that both curious and perplexing.

Any ideas as to why that may be? Your comments will be welcomed.

[BDonTJ]

On 8/17/2018 at 5:31 PM, treed said:

One note: Malwarebytes for Mac 3.4, which was just released last week and is still being rolled out at a metered pace, now has scheduled scanning.  

Indeed it does! :-)

That's the version I now have.

 

[JimDB]

I use Malwarebytes Ver 3.xx AND ClamXAV ver 3 on my macOS. So far no clashes. I also use RansomWhere? ...again other than false positives, no clashes

————————————————

Well...for those of us who use iPads for dayto day and macOS for occasional heavy lifting, Malwarebytes is a little behind re: iOS limitations. No cursor, no hovering over site data, etc. 

So, I power down MacOS every day...may not power up for a few days...so daily scheduling is of no use. 

I cant even login on iOS as a customer yet....

Manual scans are just fine. As AL says, scans in ClamXAAV are LONG...as it touches every file on disk.

Several years ago, Clam users tried to add scanning of each email before it reaches ones inbox. That worked but was a pain to maintain. Al: any email scanning scripts around these days?

 

jim b

 

Edited August 25, 2018 by JimDB
Added info

[alvarnell]

There are some, but mostly used by e-mail servers to prevent your ever receiving infected e-mails. ClamAV started out as such software and there are some add-ons list on this page http://www.clamav.net/downloads under Third Party ClamAV Tools.

There is a big problem involved in trying to check an e-mail database that doesn't store them as individual files (e.g. Thunderbird, MS Exchange). There isn't an easy way to extract individual messages and you aren't going to want to delete the entire mailbox or database.

ClamXAV can work with Apple Mail to move infected messages to a quarantine mailbox which the user can then inspect and empty. If it were to delete such messages, the mailbox index would be corrupted and have to be rebuilt. Infected attachments can also be quarantined or deleted without messing anything up.

This isn't really a major issue for Mac users. To date there hasn't been any known harm caused by a Mac user simply reading an infected e-mail. They would need to click a link or open an attachment for anything to happen.

There is a heuristics engine that comes with ClamAV that attempts to analyze phishing attempts, but it's not perfect by any means.

[JimDB]

Al : Great hearing from you on this forum. 

Thanks for the info. I understand the dilemma. I very seldom get a infected msg any more . I believe ClamXAV is doing a stellar job.  

As I said earlier, I am terrified about Ransoms. Trying to recover from my SuperDuper backups is daunting. I guess I could do it, though. 

RansomWhere? works for me OK while Sentry is alive.

 

See you again sometime

Jim B

[BDonTJ]

4 hours ago, JimDB said:

 I believe ClamXAV is doing a stellar job.  

How can you be sure that the installation of ClamXAV didn't INSTALL malware onto your computer, JimDB?

You try and make a Visitor Post on their Facebook page and ask them!  

https://www.facebook.com/search/posts/?q=ClamXAV

Do read here too ......

https://discussions.apple.com/message/33292686?start=0&tstart=0

Indeed, ask a question on the Apple Support Communities (ASC) site yourself. Something like "Why doesn't the Developer of ClamXAV, Mr Mark Allan, answer questions about his product here in the ASC?" 

If you do, please return to this forum and let us know the result of your enquiries.

Thanks.

[JimDB]

I’m not sure of what you propose? I have been a user of Clam since 2004. Mark Allan is not any creepy creature trying to take over your machine or mine.. He also does not answer to any Apple process regarding ASC. 

And if malware was installed..a recent Malwarebytes scan on my system could not find it. 

I am not trying any of your suggestions.   I suggest YOU post a question for Al Varnell, the  senior monitor of the ClamXAV forum of which I have used for over 13 years.  The Clam Forum doesn’t use Facebook at all. It has its own forum. Ask Al...he tell you how to sign up. 

FB?   Who in H*** uses that monstrosity to sign into any Forum.... Sheezze...

 

Now. I’m wondering what sort of Scam are you all about? 

I’m signing off ...

Jim B

BTW...how old are you?

Edited August 26, 2018 by JimDB

[BDonTJ]

10 hours ago, alvarnell said:

There are some, but mostly used by e-mail servers to prevent your ever receiving infected e-mails. ClamAV started out as such software and there are some add-ons list on this page http://www.clamav.net/downloads under Third Party ClamAV Tools.

There is a big problem involved in trying to check an e-mail database that doesn't store them as individual files (e.g. Thunderbird, MS Exchange). There isn't an easy way to extract individual messages and you aren't going to want to delete the entire mailbox or database.

ClamXAV can work with Apple Mail to move infected messages to a quarantine mailbox which the user can then inspect and empty. If it were to delete such messages, the mailbox index would be corrupted and have to be rebuilt. Infected attachments can also be quarantined or deleted without messing anything up.

This isn't really a major issue for Mac users. To date there hasn't been any known harm caused by a Mac user simply reading an infected e-mail. They would need to click a link or open an attachment for anything to happen.

There is a heuristics engine that comes with ClamAV that attempts to analyze phishing attempts, but it's not perfect by any means.

Hello ... Al.  

The poster JimDB has just recently said this ...

"I suggest YOU post a question for Al Varnell, the  senior monitor of the ClamXAV forum of which I have used for over 13 years.  The Clam Forum doesn’t use Facebook at all. It has its own forum. Ask Al...he tell you how to sign up." 

I suspect 'JimDB' has no clue that there is no longer any active ClamXAV forum!

If by chance I'm wrong,  please explain how I can sign up.

Thanks.

[BDonTJ]

4 hours ago, JimDB said:

I’m not sure of what you propose? I have been a user of Clam since 2004. Mark Allan is not any creepy creature trying to take over your machine or mine.. He also does not answer to any Apple process regarding ASC. 

And if malware was installed..a recent Malwarebytes scan on my system could not find it. 

I am not trying any of your suggestions.   I suggest YOU post a question for Al Varnell, the  senior monitor of the ClamXAV forum of which I have used for over 13 years.  The Clam Forum doesn’t use Facebook at all. It has its own forum. Ask Al...he tell you how to sign up. 

FB?   Who in H*** uses that monstrosity to sign into any Forum.... Sheezze...

 

Now. I’m wondering what sort of Scam are you all about? 

I’m signing off ...

Jim B

BTW...how old are you?

Well ....

I'm old enough to know better than you, dear boy!  

You should read here and educate yourself, JimDB.   https://www.macworld.co.uk/feature/mac-software/can-macs-get-viruses-3454926/

HTH

[alvarnell]

On 8/26/2018 at 1:37 AM, BDonTJ said:

Hello ... Al.  

snip

I suspect 'JimDB' has no clue that there is no longer any active ClamXAV forum!
If by chance I'm wrong,  please explain how I can sign up.

Thanks.

Well, the Forum is still active for now, just closed to new users. In fact I just had a discussion with @JimDB there last week. The ClamXAV HelpDesk is now the only official source for sales and tech support.

Edited August 28, 2018 by alvarnell

[BDonTJ]

5 hours ago, alvarnell said:

Well, the Forum is still active for now, just closed to new users. In fact I just had a discussion with @JimDB there last week. The ClamXAV HelpDesk is now the only official source for sales and tech support.

Is THIS the thread to which you refer?    https://www.clamxav.com/BB/viewtopic.php?t=4837&p=24004

As the "Site Admin" on the Forums, you must have a pretty shrewd idea of why Mark Allan doesn't participate in the Apple Support Communities (ASC).

There are LOTS of posts there by Thomas Reed - yet NONE by Mark Allan.  I find that both curious and perplexing.

Any idea(s) as to why that may be, Al? Your comments, as his faithful lackey, will be most welcome.

There's another conundrum!  

Can you explain why it is impossible to write a visitor post here?  https://www.facebook.com/clamxav/      (select 'Posts' on left hand side to show where one should be able to post)

I have asked on the Help Desk but without success.

[AdvancedSetup]

As the original question has been answered and we have no control of what happens on other forums I'm going to close this topic as it is getting off topic now.

Thank you