If you were to test ClamAV on a few thousand malware samples you would probably find that the detection rate would be in the low single digits.
At the same time, ClamAV has a terrifying CVE track record.
There's no upside, and all downside.
At the same time, ClamAV has a terrifying CVE track record.
There's no upside, and all downside.
ClamAV: https://www.cvedetails.com/product/15657/Clamav-Clamav.html?...
Norton AV: https://www.cvedetails.com/product/398/Symantec-Norton-Antiv...
Windows Defender: https://www.cvedetails.com/product/9767/Microsoft-Windows-De...
It may be safer to say that the CVE record for most AV software isn't great.
Given that, a possible upside with ClamAV could be that you could verify the behaviour of the processes on the installed systems, to make sure you're up-to-date and have the correct software and signatures installed.
That's not unreasonable - Microsoft's software delivery pipeline should be trustworthy and their security reputation could be damaged if an issue were discovered here.
That’s true of everything installed on a system - if you don’t control the software you’re running, Defender is the least of your worries. Unless you’re doing a full analysis of every binary you’re trusting the source.