Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have employees that have to search sketchy virus-ridden websites as part of their job. They all have XP and Symantec AV installed but they still get hit fairly often.

Rather then trying all sorts of desktop level solutions, I was thinking about maybe some sort of Proxy in addition to symantec for when they browse these sites?

  • Anyone have experience with HAVP?
  • Am I going about this the wrong way?
  • If this is the right way, and free alternatives to HAVP?
share|improve this question
Can't hurt. We use a commercial proxy, but I suspect that HAVP isn't bad, and something is better than nothing. Might also consider switching to a less malware-prone browser, e.g. Chrome or Opera. Sometimes I have fantasies about providing a Linux terminal server solely for the purpose of web browsing, so that Windows users would be connecting to the browsing session via X11 or FreeNX or whatever & would be completely isolated from web exploits. – Skyhawk Apr 23 '10 at 14:43
Miles: The X11 idea was actually a second thought in my mind. That might be actually possible as well because they could use only for the sketchy part of their job. – Kyle Brandt Apr 23 '10 at 15:06
How many users will be using the potential solution? – therulebookman Apr 23 '10 at 19:31
~10 users, maybe more if it works out. – Kyle Brandt Apr 23 '10 at 20:50

Why not setup some sort of virtual machine and use snapshots to reset their machines regularly? This way any viri/trojans that get past the AV can be wiped out easily.

There is also more specialised software to do this aimed more at libraries/internet cafes if you want to take the idea further.

share|improve this answer
The problem here would be those beasties that go out looking for network shares and dropping themselves off there. Of course, the workaround could be to not join the VM's to a domain (thus no permissions) or use a *nix guest OS. – squillman Apr 23 '10 at 15:40
Another issue is that 2x Windows licenses for each desktop might be more than something like an IronPort. They also don't have machines that have the power to run a second os I don't think. – Kyle Brandt Apr 23 '10 at 16:21
I've used single core P4's and athlon 64 with 2gb ram with virtual box. not the speediest little suckers, but they definitely will do what you need them to. But they may have older machines than that. – therulebookman Apr 23 '10 at 19:30

I like EK's answer- alternatively you could setup a VM host in which you could have a base windows xp install on it, your user requests one, you boot it up- they use it, get it infected etc, then you kill it when they are done. Next request comes in, boot the clean image again- and depending on the server, you could have multiple versions of windows running etc.

share|improve this answer
+1 It ends up fairly expensive doing it this way, but it is a really good solution for this sort of problem. – kaerast Apr 23 '10 at 15:30
How would this be expensive? VMware ESXi, vmware server, hyper-v server, and citrix xenserver are all free and for this application nearly all of those will install on any hardware laying around even if it's just a desktop. – therulebookman Apr 23 '10 at 15:33
as therulebookman says- this was expensive software wise 2 years ago, but with all the competition for VM server software- most of the basic software is free. I have Vmware server running on a desktop machine next to me :) – AliGibbs Apr 23 '10 at 15:37
Licensing for the OS adds expense (unless maybe special vm licensing schemes). – Kyle Brandt Apr 23 '10 at 16:22
esxi, hyper-v server (there's a free version, it's buried in typical M$ fashion, but can be found), and citrix xenserver are their own OS. Virtual Box and vmware server run on top of other OS. Edit: Of course you probably meant guest OS cost. See my answer's edit for info on this. – therulebookman Apr 23 '10 at 16:45

Agree with EK and AliGibbs. I would use Virtual Box and use the snapshot feature. Configure an XP virtual machine, update it, install firefox or chromium, take a snapshot and then virus it up. When it gets infected, roll back to the snapshot, which is really simple, you could teach your users to do it, and then surf away again.

I've never used HVAP, but I have used ClamAV and it's slow as molasses. I'd think you would have to have a pretty beefy box to run it in a proxy config and keep the users from clawing their eyes out with the slowness. I have used an IronPort and it provides AV as well as content filtering and the like, and it's nice and fast...and expensive. So it's probably not what you're looking for, but it will do what you want. It can be used in a proxy config, in-line, or redirected from firewall.

I don't know if this is a violation of the EULA, as I'm no expert in that, but When you roll back to the snapshot the activation window rolls back as well. At least with XP on virtual box. Up to you whether this is moral/ethical/legal, as I don't know. You could also install linux as the guest OS as this is free. Unless they need XP for the virus surfing activity. There are plenty of pre-installed/config'ed downloadable images for a variety of distro's. I like Linux Mint for the most XP-user-friendly experience.

share|improve this answer
Well with me as the only current user, ClamAV seems to be handling the task okay. This new version has options though, so looks like I can use AVG, Avast, Kaspersky, NOD, etc – Kyle Brandt Apr 23 '10 at 17:52

Agree as well that a VM is a good solution, and with things like Qubes(alpha) and ImmunOS (beta) in the works this approach may get easier.

To actually address your specific question, we've used HAVP on pfSense at several small remote offices for a while. Configuring it to work as a transparent upstream for squid on the same pfSense box took a little fiddling, but once it was up and running it seems to work fine, though a little more hardware was helpful than a router or proxy might otherwise need for the same number of users. Since the stock scanner is based on ClamAV (commercial AV engines are available as well) you may want to make sure it's compatible with the current signatures since ClamAV's updates are now disabling scanner versions < 0.95.

share|improve this answer
up vote 1 down vote accepted

I found this to be a stable solution that caught some viruses and didn't use too much CPU.

share|improve this answer

I like the VM option too. Another options would be to App-V Internet Explorer so you have a real nice sandbox with no access to the local machine.


share|improve this answer
Or SandboxIE, though I've no experience with it so don't know if it's any good. – kaerast Apr 24 '10 at 9:27

Virtual Machines on each desktop is a good way.

But instead of XP in the box, install a fast Linux distro with Firefox on it. Puppy Linux could be installed on a 500Mb VMWare VHD and it only needs 128Mb RAM to run.

So it should be responsive enough and also not tax the host system too much.

With a 500Mb VHD, you could set it up once and distribute this to all the people who need it. A backup of the known good system set up the way you like can be stored on a CD or a network share.

share|improve this answer

Team up HAVP + Clam/AV with Microsoft SteadyState, SteadyState restoring the state of the HDD when you reboot providing a more convenient interface than a virtual machine.

Note in 7 the function has been incorporated in order to correctly handle OS and anti-virus definition updates for which SteadyState is fundamentally flawed in design.

share|improve this answer
NB: 7 integration not in the release version, maybe SP1 or later. – Steve-o Dec 15 '10 at 5:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.