Sophos Does It Again !!

[faster4233]

We recently chose Sophos because most of the alternatives are poor. I use Nod32 at home because its lightweight and fast, and i did try the business solution but its managment tools are useless and outdated.

 

F-Secure, symantec, Mc Afee are all too heavy weight and usless. pretty much everything else is either the same or designed for small businesses.

 

Sophos Support have been excelent which was the main reason i went with them, I have actually been to their HQ and seens there resources which are very good.

 

Primarily i went with them because there Managment tools are the best. It was the only software where i could easily manage 680 machines, and monitor everything they are up to.

 

On the same note: Disabling On Access on servers makes perfect sense as large runs with backups, and mass user requests are very intensive. I believe the recomendation is primarily for File servers for obvious reasons. If its a large concern though the best solution is to have hardware AV between the servers and the users.

[HodgeHi]

I moved from Symantec 10.2 to Endpoint 11 over the 6 weeks. I must admit it is actually not bad. It has stopped quite a few little things from spreading across to other clients from visitors USB drives. I haven't even configured anything and the IDEs get updated fine the client's AV all seems to be working Ok, and more or less right out the box. I have only had to deploy the client app to the clients. Overall i am quite impressed. The reporting pretty good too with easy to read results and also nicely laid out. It does require ISS to be installed though but i think it's worth the upgrade.

 

Seems to be quite resource friendly as well.

[Oops_my_bad]

Apparently a big update to the client engine went out a few days ago (~60meg) - anyone else having "issues" with this being deployed to their clients via autoupdate?

 

I am told there will be a similar sized engine update for the firewall component too. Happy days

[lukang]

Well if everyone knew as much as you then they could use any software solution huh?

 

The biggest issue with sophos is many people dont read the documentation or dont understand what they are reading like RMS and the requirements to deploy the AV. Nor do they under stand the terms such as Do Nothing/ Do Nothing in the AV cleanup settings. Do nothing actually does quarantine what it finds and it allows the end user to safely take action against a virus.

[Oops_my_bad]

Well if everyone knew as much as you then they could use any software solution huh?

 

I beg your pardon? I know full well what I'm doing with sophos thank you very much we don't have any problems with it (granted except the minor one above a few weeks back) and it has protected us from all the nasties that have cropped up in recent years such as Confiker etc..

[gshaw]

Do nothing actually does quarantine what it finds and it allows the end user to safely take action against a virus.

 

Wouldn't it be lovely if a large software company could write their interface so you can have some faith in what it's doing! That label has been complained about enough times to be changed but yet it appears it's still there?!

 

Tbh I'm glad we dropped Sophos, Kaspersky isn't perfect by any means but it's less CPU intensive than Sophos and actually tells me what it's doing i.e. what virus, what machine, when and what was done rather than Sophos' frantic flag waving with no useful information in the logs

[ZeroHour]

We run sophos here and I have clients set to full read/write scanning which does impact performance but prevents lots of stick viruses quickly and the servers have on write access with daily scans. Read mode on servers did kill them a lot but writes are not a problem and it just means the virus shouldnt get on the servers at all.