Antivirus or Anti-Spyware - Which Is Most Relevant?

[hutchingsp]

I'm looking at what to do when our current enterprise antivirus expires (we use Trend OfficeScan right now).

In my experience, we don't find that we get many alerts for "true" viruses, we tend to find we get alerts from "grayware" and spyware, adware, with the odd trojan (and it seems opinion differs between vendors as one calls it a virus, the other spyware etc.).

I'm trying to narrow down the list (keep in mind this for several hundred PCs) and the latest SEP11 is on the list to look at, as is NOD32, Antivir would be except they don't seem interested in offering realistic pricing to move us last time I checked.

I'm wondering if there are any other vendors I should be looking at who may not be classed so much as "Antivirus" but as "Anti-Malware"?

Essentially we do quite a lot of URL blocking, and antivirus/anti-spyware at the gateway so I'm thinking how to have the least overhead on my client machines whilst covering the most real-world threat.

[funkydude]

I would suggest ESET business edition, you should also try Microsoft Forefront and Kaspersky business edition though.

As to AS/AV they tend to be all-in-one these days if they want to survive.

[hutchingsp]

Yeah Microsoft should arguably be on the list as we do have a volume licensing agreement with them.

Kaspersky is one of those products that I've tried several times and each time had nothing but problems, it's just never convinced me that I could roll it out to several hundred PCs - Trend isn't at all perfect but "better the devil you know" it has been pretty well behaved in the years we've used it.

[firzen771]

ever consider avast? its a pretty straight to the point no flash AV. with very small system footprint. new version (which is still in beta atm) has an even lower footprint. if u contact vlk on their forums or he comes here sometimes as well, im sure something culd be worked out.

[lodore]

have you considered F-secure? in case your interested it does work on 64bit OS's
its alot lighter than the older versions.

also consider Vipre from sunbelt software.

[funkydude]

Originally Posted by firzen771

ever consider avast? its a pretty straight to the point no flash AV. with very small system footprint. new version (which is still in beta atm) has an even lower footprint. if u contact vlk on their forums or he comes here sometimes as well, im sure something culd be worked out.

Sorry I disagree, Avast is no where near suitable for enterprise use.

Originally Posted by hutchingsp

Yeah Microsoft should arguably be on the list as we do have a volume licensing agreement with them.

Kaspersky is one of those products that I've tried several times and each time had nothing but problems, it's just never convinced me that I could roll it out to several hundred PCs - Trend isn't at all perfect but "better the devil you know" it has been pretty well behaved in the years we've used it.

Then I'd play with ESET/Microsoft and find which is best for your current Enterprise needs. Oh I believe there is a enterprise version of Vipre if I remember right, someone was chatting to me about it I can't remember, although not tried it myself it supposedly good.

[hutchingsp]

I did, even trialled it (Avast), but again the pricing was way off - many vendors don't seem to realize that if you have a solution that, essentially, works, it's a very hard sell to "the business" to ask for a penny more than what it costs to renew that solution.

I'm curious on opinions on F-Prot as being blunt it's cheap and doesn't seem to do too badly in reviews.

Equally G-Data always does well in reviews but I believe it's incredibly slow.

One thing we do have is a fair number of XP x64 which many vendors don't support.

Also keep in mind several hundred clients means central management is a big deal.

[Fly]

What about Avira enterprise ?

The detection rate of the consumer version is high, and you can customize it.
From what I can tell, it's good against spyware/adware, fraudulent software, security privacy risk etc. See av-comparatives.

I have no specific information about the enterprise version, just a suggestion.

[hutchingsp]

Originally Posted by Fly

What about Avira enterprise ?

The detection rate of the consumer version is high, and you can customize it.
From what I can tell, it's good against spyware/adware, fraudulent software, security privacy risk etc. See av-comparatives.

I have no specific information about the enterprise version, just a suggestion.

Same again tbh, admittedly we're talking some months back last time our license was up for renewal, but again, pricing was some way off - still have to admit I did like the product the most out of those that I tried, so will probably take another look.

One problem we do have is that we have a lot of "quirky" specialist applications and documents with macros and such-like and I have found some antivirus to be quite "in your face" to the point where I think it could cause us problems where we'd be forever having to set exclusions.

[lodore]

Originally Posted by hutchingsp

I did, even trialled it (Avast), but again the pricing was way off - many vendors don't seem to realize that if you have a solution that, essentially, works, it's a very hard sell to "the business" to ask for a penny more than what it costs to renew that solution.

I'm curious on opinions on F-Prot as being blunt it's cheap and doesn't seem to do too badly in reviews.

Equally G-Data always does well in reviews but I believe it's incredibly slow.

One thing we do have is a fair number of XP x64 which many vendors don't support.

Also keep in mind several hundred clients means central management is a big deal.

did you try f-secure last time round?

[hutchingsp]

Originally Posted by lodore

did you try f-secure last time round?

Yep, no support for XP 64bit only Vista onwards.

[Peter2150]

This is getting dangerously close to an A vs B thread. If posts keep on saying what about ..... it will be closed.

[hutchingsp]

Got Antivir up and running using the SMC today.

Now, let's be clear so as not to get the thread closed or anything silly - if anyone is using Antivir in a corporate environment I'd be interested to know how you've found it.

Not interested in opinions on it as a standalone product as there's enough of those out there in the form of reviews etc.

[funkydude]

I haven't before, but I couldn't justify using it with it's FP rate, I'd hate all the potential hassle it could cause.

[hutchingsp]

I shall be keeping a close eye on that, I presume you mean via heuristics?

I did a scan on a couple of PCs today, one it picked up a trojan on, and my own which was clean except it flagged a .js file using heuristics that is part of our firewall management console.

Basically that's the side of the like of Antivir that terrifies me, but I guess I'm unsure if Avira is very twitchy/paranoid or if Trend, well, isn't..

[funkydude]

Well, let us know how you get on

[hutchingsp]

Originally Posted by funkydude

I haven't before, but I couldn't justify using it with it's FP rate, I'd hate all the potential hassle it could cause.

Be interested in any info on heuristics. Searching now but basically if I look at things like av-comparatives it doesn't appear to say how much of a result was with heuristics vs. without heuristics.

I ask as whenever I've looked at Antivir, NOD32, Kaspersky etc. in our environment they have flagged quite a lot via heuristics, but if I disabled heuristics or set to lowest, is the "pattern file" matching still first class?

[funkydude]

Reducing heuristics generally tend to be a bad idea it's one of the main things the AV companies use now. But I'd say choosing the right business solution is actually harder than a home solution. If AntiVir works out, then go for it. If not, I'd say you would need to look at ESET, Microsoft or Kaspersky.

[dell boy]

are you not considering using mse? is there any reason using it on a big network its not so good?

[hutchingsp]

Originally Posted by dell boy

are you not considering using mse? is there any reason using it on a big network its not so good?

I have to be totally frank and say that there's probably a bit of snobbery there and the cynic in me doesn't trust Microsoft to do decent antivirus.

Of course the business level balance to that is that even based on Select agreement pricing, Forefront Client Security isn't cheap and AFAIK Microsoft don't do "deals" unless you're absolutely huge i.e. to them a few hundred seats is neither here nor there.

[funkydude]

Originally Posted by dell boy

are you not considering using mse? is there any reason using it on a big network its not so good?

MSE is designed for home users and small business, Forefront is designed for enterprise.