Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am switching from Symantec. I narrowed my selection to the following

  1. AVG
  2. Trend Micro
  3. Sophos

I am leaning towards AVG for 2 reasons

  1. Ease of use
  2. Cost

Any input?

share|improve this question

closed as off-topic by Bryan, Falcon Momot, Jacob, Ward, Magellan Jul 18 '13 at 15:18

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Bryan, Falcon Momot, Jacob, Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

please retag with windows-server – Johan Aug 26 '09 at 10:02
Please mention why you are moving away from symantec. – p858snake Aug 26 '09 at 10:10
I can't think of any single reason to stay with Symantec... – Massimo Aug 26 '09 at 11:56

13 Answers 13

While hearing from other admins is always a bonus, I also look at sites like and AV-comparatives to see what their tests have for the state of antivirus solutions. I hate using AV's anyway...can be resource hogs and they're kind of a band-aid solution. But that's just my opinion.

share|improve this answer
+1 for the links provided. I was going to look for some comparative information and didn't know where to start. – osij2is Oct 2 '09 at 20:54

Despite having used it for years, AVG is becoming such a resource hog I no longer recommend it to anyone. Sophos isn't bad but also far from perfect. Either product has a better track record than Symantec (what doesn't?). Never used Trend Micro, so can't comment on it.

ClamWin has already been suggested but it's my opinion that if you don't have on-access scanning you may as well not bother at all. Detecting an infection through a scheduled scan is pointless - the damage has been done. It's a bit like doing up a seat belt after having a crash. Some may argue that the purpose is to detect infected files, even if there is no actual virus activity. The problem with that logic is you won't know if that file has been spread yet, or how far. On the other hand, ClamWin is fantastic for things like email scanning.

share|improve this answer

I always recommend Trend for servers. It has a very low footprint, easy management and just works :)

share|improve this answer
I too like Trend Micro's business AV solutions. I especially like their hybrid web-app management console / local client installer approach, it's quite hassle-free but still provides a nice overview of ones network AV status. – Jesper Mortensen Aug 26 '09 at 13:51

Another option is ClamWin, which is free and based on the Open Source ClamAV scanner, but it doesn't have on access scanning, just scheduled. Don't know if it will work for you, but with ESET NOD32 on all our PCs that have email/internet it's a nice backup solution, and I feel better using two different products.

share|improve this answer
One vote for NOD32 – Tanarri Aug 26 '09 at 7:24
No on access/on change scan = disaster waiting to happen. – ITGuy24 Aug 26 '09 at 12:21

I question the enterprise class of AVG. Wow there is a lot of Symantec bashing going around. Would it piss everyone off if I said we use it (still SAV, not SEP) and never have any issues?

Of the three mentioned I would recommend Trend. Haven't used it in a while but its always been rock solid.

share|improve this answer
Every antivirus I've had to use over the years has stumbled or tripped up in some way. It's another irk to deal with. Maybe you've just been lucky...? – Bart Silverstrim Aug 26 '09 at 13:07
I suspect that most everyone's had to use Symantec at some point, and AV is just a hateful service to have to deal with. – Kara Marfia Aug 26 '09 at 13:13

I wouldn't recommend AVG anymore although its served me well for years. The solution today is (rather will be) Microsoft's AV scanner Security Essentials. As this is heavily based on its expensive enterprise Forefront security solution (that you'll be glad to know they purchased from a 3rd party). AVBulletin did some tests and this is supposed to be fast, light on resources and scores very highly in their AV tests.

Given MS will be releasing this for free shortly, its worth waiting a month of two for it.

share|improve this answer
It would be great to have a free and dependable AV solution. But I would think Microsoft will position this product against home users / stand-alone PCs, and not offer site-wide management consoles and similar improvements for SMEs. Have you any information about this? – Jesper Mortensen Aug 26 '09 at 13:49

I have used Eset NOD32 on Windows Server 2008 x64 and Windows Server 2008 R2 with no problems.

More recently I have tested Microsoft Forefront Client Security (FCS) with Windows Server 2008 R2 in a standalone (no Forefront/MOM server, updates via Microsoft Update). That works well too.

share|improve this answer

Another vote for Trend, very few problems other than needing IE to administer it.

Count this a vote against Symantec and McAfee as well. Both will slow things down to a crawl for no particular reason. You can't find it either in perfmon, it's like they have a deal with the devil and hide everything from taskman/perfmon/spotlight/etc. and just suck CPU cycles for their own benefit.

I dare anyone saying that they have no performance problem with Sym/McA to run a parallel test for throughput from a vanilla file server with a mixture of files and tell me that they see anything less than a 10-20% drop in performance! Most big shops don't notice anymore because they've been banging their head with it so long, they don't know what a server without all that cruft will do!

And, nearly every desktop/laptop I have to recover from near death with virii has Symantec or McAfee, cheerfully missing every virus running on the box. A personal high with Symantec was 880 viruses on one machine. I really question what exactly they think they are protecting against.

share|improve this answer

We use Sophos for our servers and workstations - nice management console, easy to use, integrates with active directory.

Unsure on price to others but we get a very good deal through our local education authority which shoots all other "quotes" to pieces. We also use Sophos Puremessage for our Exchange Antivirus/SPAM system.

The tech support, when ever we've needed them, were courteous, prompt and knowledgeable.

I have found though that their support website isn't very good.

share|improve this answer

We have Avast running here. Low footprint.

I have done any conclusive testing with trying to push a virus across to the fileshare yet so I can't comment on that section.

share|improve this answer

Are you looking for a server specific or desktop specific solution? I have found that a multi-tiered solution is the best method for servers. We have just switched to AVG on the servers, and we run ClamWin as a scheduled task after hours on top of that.

share|improve this answer

We use Trend for our Servers and Workstations and like it quite a bit. It's pretty light weight, and easy to configure and deploy. The management screen does require IE since it's all ActiveX driven, so that's a down side.

There is a known bug with it and Windows 2008, where the Firewall can dump a server (even if the firewall isn't enabled in the admin tool). I've got a couple hundred servers running it and had 1 machine have the problem. Simply uncheck the firewall in the Network properties on the machine and it fixed it.

They are supposed to be working on a fix so that when the Firewall is disabled it's actually disabled, not running with all the ports open.

share|improve this answer

Another AV testing group to look at would be ICSA Labs.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.