Slashdot Log In
Alternative Enterprise Anti-Virus Solutions?
Posted by
Cliff
on Thu May 18, 2006 10:32 PM
from the a-reasonable-request dept.
from the a-reasonable-request dept.
Darth_brooks asks: "I admin for a great non-profit organization that has spent the last year rebuilding after a massive fire. We've got a pretty tight system running now, especially compared to the unmanaged chaos that existed before the fire. Firefox for surfing and T-bird for for e-mail, WSUS for updates, and we're slowly replacing Office with OpenOffice. But out anti-virus solution (command AV, a holdover from our old system) is not cutting the mustard. Specifically the management console isn't exactly reliable, and we just don't feel like we're getting our money's worth. What alternatives can the Slashdot crowd suggest?"
"The two obvious names that come to mind are Norton and Mcafee. Since all of our machines are donated, we really don't have the resources for Norton (who does?) and Mcafee's just been dealt a black eye. In addition, we're on a limited budget. Our machines are mostly P2 & P3's, and we're an XP / Active Directory shop with some scattered Fedora & BSD boxes scattered about for non-desktop tasks.
The biggest features we're looking for are the ability to centrally manage updates (which rules of AVG's free edition), and a reasonable price tag for licenses for 50-60 machines. Our current solution is only in place because we signed a long term licensing agreement, and I don't want to see us get into another deal for a product that doesn't turn out to be as god as advertised. I'd also like to hear some of the Horror / Success stories from users."
The biggest features we're looking for are the ability to centrally manage updates (which rules of AVG's free edition), and a reasonable price tag for licenses for 50-60 machines. Our current solution is only in place because we signed a long term licensing agreement, and I don't want to see us get into another deal for a product that doesn't turn out to be as god as advertised. I'd also like to hear some of the Horror / Success stories from users."
Related Stories
[+]
IT: McAfee Anti-Virus Causes Widespread File Damage 353 comments
AJ Mexico writes, "[Friday] McAfee released an anti-virus update that contained an anomaly in the DAT file that caused many important files to be deleted from affected systems.
At my company, tens of thousands of files were deleted from dozens of servers and around 2000 user machines. Affected applications included MS Office, and products from IBM (Rational), GreenHills, MS Office, Ansys, Adobe, Autocad, Hyperion, Win MPM, MS Shared, MapInfo, Macromedia, MySQL, CA, Cold Fusion, ATI, FTP Voyager, Visual Studio, PTC, ADS, FEMAP, STAT, Rational.Apparently the DAT file targeted mostly, if not exclusively, DLLs and EXE files." An anonymous reader added, "Already, the SANS Internet Storm Center received a number of notes from distressed sysadmins reporting thousands of deleted or quarantined files. McAfee in response released advice to restore the files. Users who configured McAfee to delete files are left with using backups (we all got good backups... or?) or System restore."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
NOD32 (Score:5, Informative)
Re:NOD32 (Score:3, Informative)
Re:NOD32 (Score:3, Interesting)
It's low impact on system resources, extremely effective, and they update frequently. It catches stuff Norton/McAfee don't bother with - things not quite 'viruses' but not exactly good for you either (such as intrusive activex controls and the like).
Considering you're a non-profit, check out... (Score:4, Informative)
Good luck!
Virus free for over a decade... (Score:2)
But I will second the reccomendation for Tech Soup, they have NAV enterprise edition with bulk licenses and all that server based virus administration goodness that Windsows people seem to need. Plus there are a bunch of other non-profit items you can get (MS Licensing is dirt cheap).
Big tip though - read the fine print on 'donatioon' limitations and plan your orders accordingly. Some of them limit to which types of NPs they will 'donate' to (Macromedia), some tie in an
Clam AV (Score:5, Informative)
It comes in both *nix [clamav.net] and Windows [sosdg.org] varients and works pretty well for system scanning. It also works very well in a mail server tool-chain.
MTW
Re:Clam AV (Score:3, Informative)
Just get AVG and be done with it (Score:5, Informative)
AVG takes the approach of just working behind the scenes and doing it well...Norton takes the approach of "I need to constantly justify my existance by letting the user know I am doing...something"
AVG works great, so go with it. Their support is pretty good too from the couple of times when I needed to contact them.
It sounds like you pretty much said AVG is good and reasonable so just go with it.
Re:Just get AVG and be done with it (Score:3, Insightful)
AVG does the job well, doesn't completely take over any machine it's installed on causing massive performance problems, is dead simple to deploy & administer, and was the best value for money of all the various AV solutions we looked at.
Re:Just get AVG and be done with it (Score:2)
What's your opinion? Are these valid complaints?
I use AVG free on my home systems, and recommend it to many friends-- performance does seem much worse when AVG is running (this is my non-objective opinion). I've never seriously evaluated it for the business (I'm not the Windows admin).
Re:Just get AVG and be done with it (Score:4, Informative)
Parent
Re:Just get AVG and be done with it (Score:2)
Re:Just get AVG and be done with it (Score:3, Informative)
My laptop is a P-III 600MHz / 512Meg RAM running WinXP Pro and frankly, AVG doesn't seem to have any impact on performance at all. If I do nothing, Task Manager reports 0% usage, so I don't think that AVG gets much in the way.
What AVG does do is a dayly check and if you're working while it does that, you might "feel" it. Normally it's at 8am for me, but I don't know if its a rule (or if I configured it that way) At 8am, I'm so sleepy that I usuall
Re:Just get AVG and be done with it (Score:4, Informative)
Ad-Aware's free edition is called Ad-Aware Personal and updates have never stopped being free. In fact, I just tried it myself, just to make sure. Go here [lavasoftusa.com] and see for yourself.
Parent
Re:Just get AVG and be done with it (Score:3, Interesting)
ClamAV/ClamWin (Score:4, Interesting)
Re:ClamAV/ClamWin (Score:2)
F-Prot (Score:4, Informative)
I just checked, and a 60 seat corporate license with full updates would run you $240 a year.
Re:F-Prot (Score:3, Interesting)
And they've never once given me any reason to believe they're in anyone's pocket or have any hidden agendas. Just a good reliable AV solution at a minimal price.
pay for avg (Score:4, Informative)
actually, wouldn't the license agreement rule out AVG FREE edition in your situation?
however, they do have a fairly decent commercial product for the price. look at their network edition http://www.grisoft.com/doc/Networks/lng/us/tpl/tp
Uh, use open source? (Score:2)
Do you have any specific requirements that would not allow this to work?
I'd call AVG... (Score:3, Interesting)
Re:I'd call AVG... (Score:5, Informative)
AVG Admin will save you time. If you use Windows Desktop Protection in the Shared Computer Toolkit, Grisoft will even send you the script for auto-updates when Windows Updates from your WSUS run.
AVG Free edition is ruled out by the licensing which doesn't cover non-home users pretty much. Even libraries are excluded from using it legally.
Parent
AVG (Score:2, Informative)
Sophos AV (Score:5, Informative)
Don't get TrendMicro OfficeScan (Score:3, Informative)
Re:Don't get TrendMicro OfficeScan (Score:4, Interesting)
Parent
Get Sophos (Score:3, Informative)
Setup MailMonitor on a Linux box for incoming email scanning and you will end up with a solid AV solution.
Symantec Antivirus Corporate is Better than Norton (Score:2)
Cost will still be an issue though.
Bitdefender (Score:2)
AVAST! (Score:4, Interesting)
The best part is you can download it and run it completely unrestricted for 60 days to see if it works for you.
Re:AVAST! (Score:2)
The home edition is free, you merely have them send
Re:AVAST! (Score:3, Informative)
I agree. I recommended AVG for years to my customers, but decided to give Avast! a try on a customer's infected PC after AVG. Avast! found a virus AVG didn't and uses 15%-20% less memory.
But I also recommend winpatrol [winpatrol.com]. Not an AV program, it blocks out most malware, including some of the nastier stuff that can stealth-download itself into a Windows computer as long as the user is online. It only uses about 4 mb of memory to run in the background -- but I have no idea how much an enterprise solution would co
Linux (Score:2, Insightful)
Re:Linux (Score:2, Insightful)
Sophos SBE (Score:2)
Kaspersky Anti-Virus (Score:2)
Hit their website [kaspersky.com] and you can even get a 1-month demo [kaspersky.com] from them to see if it'll work for you.
Don't discount McAfee (Score:2)
*Note to open Source software makers - this is a good example how to
Don't get McAfee (Score:2)
The fact is that McAfee allowed that to happen. For something like that to pass their internal (nonexistent?) testing procedures means their processes are really _crap_.
Sure most companies have crap processes, but when it comes to mass deletion of files crap, it's time to walk away and not look back (unless you're going to sue them).
A few other AV companies also have had similar problems: Sophos had a false positive for Mac OSX
Symantec, unfortunately (Score:2)
I do have ClamAV scanning incoming emails, but it is still necessary to have a local AV on the machines. I don't like Symantec and find it too expensive, but I must say it really works. So I did a fresh minimal install of Win2K on the old server box, and setup Symantec Enterprise on tha
Why do you need "a local AV"? (Score:2)
If you are letting users download random EXEs off the Internet and running them... ugh. Well, you could always set up a proxy to run them through ClamAV...
Personally, I use ClamWin on my Windows desktop, and I scan maybe once or twice a year. Other than that, I just keep things sane -- no random downloads of EXEs, no running EXEs from email attachments...
And how do you know it really works? Maybe Symantec just "finds" something now and then in order to keep you scared...
Re:Why do you need "a local AV"? (Score:2)
Because people insert random CDs and USB keys, and they check their personal email through webmail, etc. (and someone infected his brand new laptop on which the AV was not installed yet, with an exe in a password protected zip, which he got from his private webmail acount! Yes, they do that sort of thing. At least once)
I don't scan my own machine regularly either, and also just "keep things sane" and occasionally scan a virus out of curiosity to see what it is.
You obviously don'
Kaspersky (Score:2)
Uses even fewer resources than AVG (they claim to work with Pentium Is, but I've never used with anything lower than a 500 MHz P3), and far better at actually stopping viruses.
Their info can be found here: http://www.kaspersky.com/kav6 [kaspersky.com]
ClamAV is quite good - but there are tricks (Score:3, Insightful)
Personally, I use ClamAV on the mailserver (incombination with Xamime - http://xamime.com/ [xamime.com] works well and keeps a majority of the things out.
However, you really need an orthagonal approach too, that includes banning things that aren't meant to be coming into your network in the first place, as well has having perhaps a different branded AV agent on the client machines.
Getting rid of (if possible) the vectors used by the viruses on the workstations helps a lot too. ActiveX, Macros (okay, not many people can live without those in office I suppose).
AVG's Pro Edition (Score:2)
F-Prot (Score:3, Interesting)
$5 per PC/yr, less in volume. At >100 it goes down to $2/yr.
A bit of a clunky interface, but the users will never have to bother with it. Set it to auto-update from a server (which updates from f-prot), tell it to mail you when a virus hits the real-time scanner. Simple, cheap, fast, and effective. The updater and real-time scanner take less than 1MB memory.
Try the free trial, keep the (free) DOS scanner on a bootable CD with your tools, even if you don't buy the GUI version.
Boot From CD (Score:2)
Software Restriction Policies (Score:2)
Great response (Score:4, Informative)
Second: cripes, I've finally developed computer user grammer. It passes spell check but not basic grammar.
Third: some clarifications. The reason we keep AV running is that is because it's the right thing to do. Firefox, T-bird, and the firewall keep most of the bad stuff out. OpenOffice will cut down the risks even further, but we've still got a couple of points of entry to worry about. One is laptops. Even though no one has admin except those who need it (me and the other members of the tech. group), users can still install some simple programs. It's only a matter of time before somebody gets a network aware worm and brings the machine on site. Another point of entry is USB drives. We're pushing people towards those instead of floppies for the sake of relieability. In order to balence safety with usability, we add the layer of protection offered by AV.
In addition, WSUS isn't always on the ball. Occasionally you get a machine that quits grabbing updates, or one that never showed up in the first place. It's nice that I can keep those machines somewhat better protected with an additional program. On top of all that, we're an all volunteer group, so AV software gives us an addition layer of "false sense of security." I know that I can count on the firewall, the patch server, AND AV to buy me 48 to 72 hours of safety should the crap hit the fan like it did with Sasser or Blaster. Anti-virus, like any single layer of protection, isn't infallable, but it damn sure helps.
Linux: We're doing that in some areas, but the whole site isn't an option right now. Most of our users are technophobes, usually retirees. Actually, recovering technophobes now
Thanks again for the responses. I've gotten exactly what I wanted, solid reading material for a few days and some worthwhile points to ponder.
Trend used to be good (Score:2)
Try AVG.