file intrusion detection prevention - feature

[ayoub-abdessadak]

Could you disable accessing or executing a new file added to the computer (for example downloading, pasting etc), then scan it and if its safe grant access for opening it.

[squalou]

If I may, this feature exists in clamav already.

https://docs.clamav.net/manual/OnAccess.html

Now, probably a UI over OnAccessScan config might be interesting but that's another story entirely.

[ivangabriele]

As @squalou said ClamAV already provides a CLI way to achieve that via clamonacc and a few config tweaks.

I definitely plan on adding this feature within ClamAV Desktop with a fully custom feature though. Indeed, starting from the next release, ClamAV Desktop will have its own clamav-desktop-daemon cross-OS service and won't use clamd (or any other related daemon binary) anymore.

The idea being that ClamAV Desktop should work like any regular antivirus with on-access scanning enabled by default among other common features.

But I won't have time to work on that feature for the next v0.4.0 or it will never be released!

---

Similar to #115.

[squalou]

should work like any regular antivirus

are you sure ?

I mean : do you plan to develop your own antivirus ? IMHO clamav today is missing a UI. Maybe a friendly installer. You may waste energy and time trying to reinvent existing things rather than use them.

(and what is 'regular' by the way, it highly depends who you talk to)

Of course that's just an opinion, and everyone has one so do as you please, and anyway thank you for your work !

[ivangabriele]

At first I tried to only orchestrate their daemon but:

• It ended up being a lot more complicated than just re-implementing certain parts (but it's challengeable since it's limited to what I found, other may find better ways).
• It limits multiple features to the original ClamAV features, and I dare to wish having some more (regarding daemon abilities and real-time protection for examples).
• More importantly, and the main reason for ClamAV Desktop existence, it's not a user-friendly experience to force users to first install ClamAV oand then install a GUI on top of that. Especially for non-techies. And it would be a hell to align the GUI with evolving ClamAV version and config files.

I recognize that the last part is totally opinionated but that's kind of the reason why I started this project ^^.

That being said I don't and won't re-implement ClamAV core code. That's why I "just" (this was not easy!) build and embed clamav as it is from their repository without touching a thing there. Same goes with default virus definitions management (users will be able to pick other sources for their definitions but it's their choice).