Anti-V - What do you use

[john]

Ok, My Sophos Licence is up for renewal in the next 60 days or so, and it was agreed today that we would evaluate some alternatives rather than either saying "Yes please Sophos, another few years of potentital hell" or "No thanks, see you in hell".

 

I would be very interested in seeing what others use, and your views, both good and bad on them. One thing that is key for us is 90% of our servers are dual carded for 2 seperate LANs (Admin & Academic) so the anti-virus must be able to talk over one or the other, and be able to manage, unlike Sophos originally which got really confused with 2 cards.

 

Also XP Home must be a supported OS for it, unlike Sophos where it is not supported (they do try to help you, but they don't officially support it). Cost is not the number 1 thing on my mind, as we can juggle / haggle etc when we get to that point, so don't think I may not be interested as its more than Sophos, as Sophos has gone very expensive compaired to its original prices - used to be around £150 for entire site (about 250 machines, inc 25 servers) now its up to around £2000 for the same!

 

 

So far on my list to look at is:

Symantec Anti-Virus

Trend Micro Anti-Virus

AVG

Avast

Panda

[webman]

All of the schools in our LEA (Durham) have a subscription to Symantec Corporate (completely different to the retail Norton stuff, please don't judge it by those standards... 8)) and I can say that it's great, it does the job

[john]

Thanks for that Craig, I must admit, I fancy a good look at Sav corporate, anybody near to my area who uses it? I feel it may be slim in North Yorks / Lancs border as NYCC uses Sophos, and I think I heard that Lancs use Sophos, but Dos_box will no doubt confirm or tell me I am wrong.

 

I have requested an evaluation kit from Symantec, but its always good to talk to people and potentially visit them, as well as using this excellent resource.

 

I don't mind Norton Anti-V for home use. Especially when I got a free copy from Symantec, with a 13 month sub, so I am not going to argue.

[ChrisH]

Lancs use Sophos :?

[webman]

I'm not a sales person, but Symantec Corporate's administration interface is an MMC snap-in, features remote client installation (via RPC I think), clients receive definitions from local server and has very little overhead.

[john]

Sounds nice then Craig, I will ring Symantec on Monday then and give them a good proding

[Norphy]

We use McAfee which is provided to us FOC by our LEA. Like Symantec, it's centrally administered from a central inferface, again an MMC snapin. The nice thing about EPO (the central administration console) is that it can manage all of McAfee's corperate products like Groupshield, spamkiller and others. It can also handle updates for other antivirus products too from I can gather.

[russdev]

so what is Sophos like as we currently run rm vp which is symantec corporate rebranded but at very cheap rate problem is can only license cc workstations with that price and we have to buy in for laptops at standard price..

 

which leads us to having seperate virus contracts and means already got it split into 3...

 

so we are looking at alt which company have suggested sophos (waiting to see if can lower price)

 

so whats software like assume it dfoes central managment etc like symantec...

 

russ

[john]

I am not keen on Sophos, due to many problems (mostly commented on this board) so am keen to move away. When its working its brill, but when its not working well, its a nightmare and can let viruses in and kill your system, which is not good. I would be keen to try and use Symantec. But am open to ideas and others thoughts so I get the best product for the job as its alright my testing, but whats support like, usefrienldyness etc....

[everton4europe]

Trend i have never run into problems with. the new version also scans for gaps in updates on the windows os. With teh server side you have one machine with the main program on and this distr4obutes out. it also removes any old versions/other companies av then installs there own. but with the server with the main program on it uses 2 licences. Also they offer substatial education discounts. The company i deal with is Network Defence on my licencing. Also they will cover multi sites on one licence

[john]

Thanks for that info, keep it coming!

[Andrew_C]

F-Secure. Not my side of the system, so I have no knowlege of why we use it, or if it does whatever it does, well. However, so far, it hasn't just sat there and let all sorts of nastyness happen. Thanks Sophos! :-(

[deanc]

currently sophos until the subscription runs out later this year. never had any problems with it but i think the current plans are to go with McAffe as we apparently have a site licence from our LEA (Northants) for the admin network that we can use on curriculum, we use McAffe on admin but tend to leave it alone so i dont really know how good/bad it is

[openhgs]

On 95% of our machines we use Linux, which is by far the best A/V solution. On the admin machines we run Sophos, basically 'cus the LEA won't let us connect to their grid unless we DO run Sophos. Sophos is not my favourite A/V solution for machines running M$ operating systems. Sophos does not trap all known virus's; a specific example is msbb-a. To quote from the Sophos web site "Following customer feedback Sophos has disabled detection of this application, which is not a virus." There is plenty of references which state that msbb is a well known security risk. It is spyware, written by 180solutions.com. One could surmise that the customer who provided this feedback was 180solutions, or am I just being cynical?

[broc]

Symantec Corporate (same LEA as Craig). Server contacts Symantec daily, downloads any updates & deploys to clients automatically. You can push the client code out to any workstation on domain (haven't tried XP Home) from MMC & interrogate clients regarding status & history.

[RoyG]

McAfee, free from LEA. Fine, no problems.

 

RoyG

[witch]

Dorset uses Sophos - all staff can use on home computers for free. I don't have any problems with it but then again I have a very simple system - not at all like some of you, I know. I have one network that I have to update manually (NT4 server) and one that is set up to do it automatically. Computers occasionally lose their grip on it but that is more to do with their age and the fact that they are running Windows 98.

I think the website isn't much good as it is difficult to find details of a virus - that is, what it does - without knowing its name! The support staff are very helpful though.

[john]

Thanks for all that feedback, please do keep it coming, its interesting to see what a large strangle hold Sophos seems to have, will this be the same in say 5 years time I wonder?

[thom]

We use McAfee Enterprise 8.0i and it's fantastic

This is provided by our LEA (who managed to get something right for once!) Have you checked with yours to see if they provide anything as I only discovered it by accident.

 

As well as VirusScan 8 you get a load of other tools like Alert Manager, ThreatScan, Installation Designer and others.

 

For central management you can use E-Policy Orchestrator (EPO) or Protection Pilot (PP) (for 500 PCs or less). At first I was using EPO but it was quite hard to set up and the server didn't always update. I then switched to PP thinking it would be inferior but it is fantastic. Much more user friendly but all the power of EPO. I had it setup in about 30 mins and it automitically deployed and upgraded some out date PCs that had been missed for some reason. I did a quick network scan after school to discover about 75% of PCs weren't up-to-date and there were 50 viruses/trojans and 68 pieces of spyware! No wonder my network was a bit of a drag. I would thoroughly reccomend it. We never did scheduled scans or check for updates locally as it took to long but now I can set it up to scan everything overnight with the latest updates!

[john]

We are an independant school so no LEA tie, I know the LEA (if we were an LEA school) supply Sophos as I do work for some LEA schools as well, and they are now into the last year I think of the Sophos agreement (somebody who is in NYCC will no doubt confirm that or not). I have written McAfee off after the press the other day about them stuffing up by making it quarenteen or delete Excel and another valid program with some false positives, I know we all make mistakes, but thats quite a critical one for us as Excel is widely used daily, so its quite major.

[Disease]

We use Norton Corporate and it is great. Very low maintenance overhead, which keeps me happy.

[john]

Once again, many thanks for all the info you have posted, its been most useful. I have installed Trend Micro on my test server and a few workstations today, it seems nice, but am going to try Symantec corperate as well once my evaluation pack arrives. I can see that I will be making a few temp test servers from those spare workstations I have got lying around at present to test these things out.

[krisd32]

We use sophos in our LEA i'm happy with it and find it easy touse with the central management system they use. i've used symantec before but not to the extent of knowing it well seemed really good to use also!

[Mikey]

Sophos Enterprise here. A good Console interface - I can recommend it. The only problem I would say is if your server fails, you'll be starting from scratch because twice now the console seems to have lost connection to the domain (the server's connected fine, it's just Sophos goes bonkers!). But when it's working, it works well.

 

Easy to dish out the updates, and new installations.

 

Good reporting system too!

[MrDylan]

We use sophos, only real gripe I have with it is it's such a resource hog. We're talking 32Mb RAM constantly devoted to it.