Please recommend a network-wide antivirus program/suite

Question

We are currently using Sophos Enterprise as our company's anti-virus. I don't really like it and I am the only IT guy here so I have the sway to make change. What other non-personal anti-virus software packages would you recommend? I have a suggestion of Microsoft Forefront. Any comments?

Answer 1

If money isn't a huge deal, the best I've worked with is Trend Micro, hands down. Unfortunately, they're also the most expensive...

Symantec and McAfee are fairly common and straight forward (although they seem to always have little issues in larger deployments (20k+ hosts, for example). Given you're the only IT guy, I'm going to assume that's not going to be a problem for you :)

I've not used Forefront, and it does not appear to be 'anti-virus' centric - it's more of a security application, most likely to be used in conjunction with a dedicated anti-virus app (because we all need 5 scanners on our pcs!).

Keep in mind (and this may be a complete non-issue for you), that Forefront is Windows-only, while other products are cross platform (if you have a Linux file server, for example).

Answer 2

I recommend Symantec Corporate Edition, just not the Endpoint Security version. I still run 10.2 and love it, Endpoint was more hassle than anything.

Answer 3

I've used a number of applications - at least on a limited basis.

• I actually liked Sophos, though it did have issues deploying to some PCs - especially Vista PCs. This seemed related to SMB ports, but we were never able to nail it down. Still, the management tools were decent and easy to use. They also had good support.
• The Symantec A/V client is lightweight and seems effective. In the past, you had to upgrade the management console to upgrade the client product version. To upgrade the management console, you had to uninstall, backup your certificates and other company-specific info, and reinstall. So if you wanted to go from client version 10 to client version 11, you had to first backup and uninstall the v10 management console and then install v11 and restore the data. It was a pain in the neck. Their online support was OK, but their telephone support was terrible.
• The Microsoft Forefront Client caused noticeable performance slowdowns when compared to NOD32. I didn't try the Management Console.
• I've seen an older McAfee client that seems OK. It's been too long since I used the server piece to have an opinion. I've seen a bunch of weird problems caused by McAfee's Access Protection -> Prevent downloads from the World Wide Web setting, but my guess is that it's more a configuration issue than a product shortcoming.
• I use NOD32 on my machines at home, but I don't know anything about their management tools. The client is lightweight and anecdotal evidence says it's effective.

So, this doesn't answer your question. All of the products have their issues. I'm not sure I'd try to buy on antivirus cleaning performance, as that seems impossible to measure. I'd probably buy on price, ease of administration and client performance, with the caveat that the new product should solve whatever problems you're having with Sophos.

Answer 4

Trendmicro officescan gets my vote. Trendmicro

Officescan 10 is the lastest version and has some great new features.

Answer 5

McAfee TVD is what I use.

Answer 6

We use Eset NOD32 on our desktops. With the latest version of their management tool, it is definitely a suitable replacement for the "fatter" antivirus clients. The HTTP proxy built into the client does a good job and preventing infections before they happen (versus alerting you after the fact).

My reseller recently mentioned that he has seen a lot of interesting in Sophos and Kaspersky recently too.

Answer 7

I'm of the opinion that all AV products have their bad sides, and as such you're better off sticking with the one you know, even if you don't like it, as at least you're accustomed to it's quirks.

If what you've got is genuinely objectionable to you, what I can offer is that we are a Symantec house, and although I don't manage that side of things, the guy who does seems to be OK with it. We don't have SEP though.

Having said that, I'm watching Microsoft Security Essentials with some interest, as it seems to be specifically targetted at end users and smaller orgs, is testing well, integrates with Windows Update, and is reported to have an incredibly low resource utilisation.

Answer 8

So far Sophos is top winer with McAfee, depending how you look at. If you are looking for best detection, then Avira is way to go if you running small shop ( below 500 PC). Other then that, you can stick with Sophos, it does best job and support is one of the best. Before we start doing Sophos, we were in bed with Trend Micro for years but recently they had issue with OfficeScan (no one wonder how they came from version 8 with a lot of bugs, holes and fixes to version 10 with service pack 1 already ???) OfficeScan requires you to download manually some stuff and install it (security related). With Sophos and McAfee it is done over console automated. You can see number of test and Sophos is almost always first one. However, Sophos has weird way of licensing: in order to ger disocunt, you need do to more years which is sometimes problem with government, budgeting year-by-year ... I did test on all 5 enterprise solutions (TM, Sophos, CheckPoint, McAfee, Symantec) + Avira. Avira for small shops, Sophos if you don't require single management console for web gw, firewall and some other stuff, McAfee if you are runnig for example Procurve switches... Nothing is perfect but one thing is always better then another one ... Best regards, Damir