AV Strategy

Lets get a discussion going on general Antivirus practice.

It seems many people have different perspectives on AV, heres a few:

-No AV is necessary
Some would say that no AV is necessary if you are configured and updated like you should be. I personally think this is valid in a sense but after the MS04-028 GDI+ vulnerability, it makes me wonder. What would happen if the vulnerabiltiy went unreported? There is no way to secure Internet Explorer from it, unless you don't load images. (btw would MS04-028 effect FireFox?)
-Multiple AV's
One might think that running multiple AV's would check the results of the other, but that can lead to errors while checking files and severe performance issues.
-Single AV
One strong AV solution to protect your box.

My opinion is that a single AV is necessary on mail and file servers. On a workstation, could a multiple AV solution work out? Clamwin doesn't have realtime protection AFAIK, and would not interfere with software like Norton that uses realtime protection. Would there be any benefit to running a realtime AV like Norton, with a sidekick AV like Clamwin? I understand and believe running two realtime AV's like McAffee and Norton isn't smart for reasons stated, but I don't think Clamwin would interfere with performance of another AV?

Anyhow, what are your Antivirus setups, or do you think they aren't necessary?

//me goes to chipotle

edit:
My setup is one AV, Clamwin. It is lightweight and the defs are updated well. If you want, you can make your own defs, which rocks. I like Clamwin a lot, I might write a tut to support it.

I believe in a single A/V solution (one that is proven to work thoroughly and effectively) with updates and definition's that are able to be downloaded at any given time. As long as I stay on par with updates and definitions (my A/V solution must have those capabilities) then I'm comfortable and believe that I can't be infected (well, that and using common sense with certain things).

This solution (the one I use) has never failed me and I can't even remember the last time I was infected with a virus.

I do get infected every so often. Usually because my wife goes to alot of puzzle and game sites that usually offer something for 'free' that she just has to sign up for.

But I am using the Avast free AV and it is working great. It catches most of the infections before they get on the box and every thing else with in an hour or so. I run Trend's Housecall about once a week and it has never found any yet that the avast has missed. I am very content with the way I have my boxes set at present, but then again I am always looking for something better ( and free also).

No one single AV will be able to catch all viruses (especially 0 day nasties!) but I think that as long as people are security minded they will update their signatures regularly or allow the program to update itself. Companies are always on the look out for something new that hasn't been discovered yet and they are doing their best to patch their software in a timely manner. Good surfing habits and keeping in the forefront the ideas that AV software is only as good as the latest and most up to date files should protect the majority of us from getting to infected.

My personal opinion is that a single AV suite is suffice:
My background is that I'm not too educated IT wise, and so, I bought the Symantec NetSec 2004 suite. [ A name I had heard of, and a complete package ]
that is, it covers everything, and each part is compatable with the rest [allegedly]

Quote:

---

No one single AV will be able to catch all viruses (especially 0 day nasties!)

---

No one will catch zero day exploits.
Because they are zero day............
But the AV providers will get something ready ASAP. [allegedly]

I don't believe one will catch all zero day exploits, however combine it with knowledge/wisdom of the subject, common sense, and always updated updates/definitions and you got a pretty good strategy. One that has never failed me.. :)

as part of Norton Internet Security 2003. It hasn't let me down, as far as I'm aware! I update it every time I go online, it's the first thing I do!

I'm with SecGod in that whatever Anti-Virus software you use, it's only as good as it's last update.

As for Zero day exploits, there's no guarantee but heuristic analysis may catch one or two? Norton has heuristic analysis, so to me that is a good thing.

As for Norton being intrusive of your system? Well yes it is, but that is due to the in depth level that it works at! Yeah, I could utilise an Anti-Virus package that is less intrusive, however, this requres the user to be competent and security minded. Other people use my home PC, so I have to consider my needs to protect my home PC from them! lol

You pays yer money (or don't (in the case of free personal editions)) and takes yer pick!

Simple Simon: I'm just wondering, but in what ways are Norton intrusive on your system?

Perhaps intrusive is not the right word, more intense? It runs a number of processes which can be resource intensive! An example being it scans incoming and outgoing emails by default! This causes a slight delay for me and the other users when reading or sending emails, however, to me this is a small price to pay for the protection it affords.

Hrmm, I must not have that package or whatever (mine doesn't scan my e-mail's, whether outgoing or incoming). I'm interested in the processes that run with Norton, I know of a few but can you share some of them with me (particularly the one's that take up the most resources) and which one of them are not needed to be run. If they are taking up resources, I'll close them/turn them off because obviously I need to conserve resources on the system.

What do some of our network admins use on their servers?

I did emphasise the "Can," part of

Quote:

---

It runs a number of processes which can be resource intensive!

---

Have a look at the attached window capture of my current processes. The Norton ones are:

Navapsvc.exe
ccEvtMgr.exe
ccApp.exe
CCPXYSVC.EXE
NISUM.EXE


These Norton process run at startup:

ccApp.exe - see link above
ccRegvfy

Does that help to explain?

LOL, I'm not pressing you into it man, sorry if it came across that way. I just really want to know so that I can conserve resources and learn more. That's all :)

Anyways, wow.. looking at the attachment I can definitely see that it takes up a good deal of memory usage/resources on your system. I see what you are saying now, thanks for clarifying for me and explaining.

Hey Hey,

I'm a proud supporter of AVG... I think it's about the best of the AVs... The free version has never failed me...

I ran without AV until last year when we were required to have AV installed in order to access the network at the college... I believe that properly patched, secure computers will do the trick.. Scan with online solutions (like TrendMicro's Housecall) or solutions that don't have to be installed like (SysClean from TrendMicro or (eww) Stinger from McAfee) once a week or every two weeks and that's all that's really required....

I like AVG for a number of reasons:
Scheduled Automatic Updates (for free... no need for this Subscription crap) and Scans
Email Protection and Realtime Protection (again it's all free and the Email protection works amazingly well)
It's not a memory hog like Norton
It's Free!

However, I'm almost tempted to check out TrendMicro's RealTime AV Solution... I'm most impressed with SysClean... we've had major problems with infections of SpyBot/SDBot/Forbot and Norton can't clean it, eTrust simply renames it... I wrote a batch file to clean it... but it was a 40K batch file and was growing daily... then I stumbled upon SysClean and it cleans all the variations quite easily and simply and also scans for several other viruses across the harddrive.... remove dormant copies as well as the active ones.

In the college... the standard is eTrust... We have it liscensed for all Machines in the college, all ITY students, all Residence Students and Staff and Faculty to take home for use on their PCs. I find it to be useless software... It ranks right up beside McAfee for being the biggest POS ever... Our network is riddled with viruses because eTrust doesn't have nearly complete or indepth enough definitions... it's useless software... McAfee is just as bad... It's distributed to all residence students at a University about an hour - hour and a half from here... My cousin and her friends all attend there.. I cleaned 1000s of viruses off their computers when they moved out of the residence... McAfee was completely up to date.. just had very poor defs.

I've seen residence students with 100s of viruses while running RealTime AV protection and I've seen knowledgeable users with no AV and no viruses.... You have to factor in knowledge (sense to run a firewall (hardware or software), install patches and updates, and not pirate a bunch of **** from kazaa, limewire, winmx, etc)... P2P programs are definately the number 1 source of viruses.... We've cleaned students and within a few hours had them back again with virus riddled computers... They went back to their room and installed MSN and P2P software and boom.... picked up a shitload of stuff.....

AV is nice.. and handy.. but it's not an end all solution by any means.. Used in conjunction with security, updating, firewalls, malware scanners... it can keep a user quite safe.... but safey comes from knowledge.... Most users would be better off dropping the over priced norton subscriptions.... getting a free AV solution and spending the saved money on a computer basics class...

Peace,
HT

Quote:

---

Originally posted here by Soda_Popinsky
What do some of our network admins use on their servers?

---

For corporate desktops I've used {N|S}AVCE 7 and 8 (8 is far better).
For mailservers I have used kaspersky's mail plugin on qmail and it worked really well. Since it wasn't free, and now I think they charge an amount based on the number of mailboxes and domains it will support whereas before it was a flat fee, I'd definitely look into ClamAV.

On my home fileserver here I have ClamAV, and it seems pretty lean and it does its job.

Quote:

---

By HTRegz

Most users would be better off dropping the over priced norton subscriptions.... getting a free AV solution and spending the saved money on a computer basics class...

---

Do you mean me? lol

I was considering AVG for when my subscription for Norton ends. Now though, I will be investigating clamwin, especially since thehorse13 recommends it over AVG!

Quote:

---

Originally posted here by Simple Simon
Do you mean me? lol

I was considering AVG for when my subscription for Norton ends. Now though, I will be investigating clamwin, especially since thehorse13 recommends it over AVG!

---

Hey Hey,

Definately not you... the idiots in residence that waste their money on it... :P heh...

TH13 recommended Clamwin? I may have to check it out also.. Soda piqued my curiosity and if TH13 uses it too I'll prolly give it a looksy...

Peace
HT

HTRegz: I'm actually about to download and test out AVG and see how I like it, the general feel, if it tickles my fancy, etc but I had a question. This is a newbie question, but it's probably because I never tried to: You can fully un-install Norton from your system, correct? The reason I'm asking is because when I get AVG and if I like it, I don't want Norton to interfere in the performance/etc of AVG. Thanks in advance man.

EDIT: TH13 recommended Clamwin over AVG? Hrmm, and I've heard nothing but excellent things about AVG (and Clamwin for that matter).

Quote:

---

You can fully un-install Norton from your system, correct?

---

I would hope so!

I've decided to write a tutorial on clamwin and custom signatures and maybe other stuff too. I will probably start it tonight, post it in the next week or so.

The more people that use clamwin, the stronger it gets!

In terms of the GUI

AVG is soooo UGLY!!! But it's usable, so thats what counts. I prefer ClamWin anyday though.

I was using AVG, but because of the recommedations here I'm going to try ClamWin. SodaPopinsky, can you give a reason you like it more? I'm just curious for your opinion. Thanks!

Regards,
Xierox

1. Does not have realtime protection, just a scanner.
2. Open source (I think the only one that is reputable)
3. Custom sigs
4. Configuration includes filters, so I'm not scanning text files or my .mp3 library.
5. Sigs are updated frequently
6. Free and sexy

I believe because it is open source, the more popular it gets, the stronger the scanner will be. Developers will be able to help out with signatures and be very quick with their releases. It is just a virus scanner and nothing more.

http://www.fortinet.com/doc/FGT3600DS.pdf

I've heard of "Hardware" Firewalls...

Would this be considered a Hardware Antivirus? How could someone make a router with AV that scan's traffic like that Fortigate? Is there a linux distribution that could do that?

Smoothwall = hardware firewall, x = hardware antivirus?

Hrmm, I have a question.. Is this a good solution: Having Norton as the primary A/V application and continuing to use it (I think someone else stated this aswell) until the free subscription is up alongside AVG as kind of a "backup" A/V application which will be a secondary and will do all the scans in between of Norton. Basically having them work together instead of one. Is that a good solution?

If not, what do you recommend I do? Get rid of Norton and just use AVG?

As long as realtime protection is not enabled on both, only on one, I don't think it will be a big deal.

Indeed.. because if it is it would get annoying or because it would cause something to not work properly? I believe Norton has realtime protection enabled by default although I never noticed so I'm going to turn that off and leave AVG to have realtime on.

I was asked in PM what {N|S}AVCE 7/8 are, so I figured if one person asked others unfamiliar with the acronym might want clarification as well.
NAVCE = Norton AntiVirus Corporate Edition
SAVCE = Symantec AntiVirus Corporate Edition

EDIT:

Quote:

---

Originally posted here by Soda_Popinsky
Is there a linux distribution that could do that?
Smoothwall = hardware firewall, x = hardware antivirus?

---

If you had a configuration that featured a proxy server, email server, etc., and were able to pass the traffic through a real time scanning engine, there's no reason it couldn't be done on linux. I'm not too up on my proxying with Apache or Squid, but something like that may be possible. Might be something to research if you are really intrigued by it. :) I know the three most popular unix mail servers (Sendmail, Postfix, and QMail) will easily support AV scanning and such, and I have worked with that. You'd be surprised how easily you can keep your network clean with only simple email scanning and desktop AV clients.

Quote:

---

Originally posted here by Soda_Popinsky
1. Does not have realtime protection, just a scanner.

---

By "realtime protection" you mean like it doesn't scan every file you open for being a virus, right? If I'm right, I can understand it'd probably speed up your system, but do you consider this worth the possibility of getting infected because it's not scaning stuff as you open it? Trying to learn here, it's an honest question.

Xierox

Correct, it doesn't scan files before they are opened, check HTML for malicious .js, check incoming and outgoing mail, or instant messages or anything else. I don't like software that insists on becoming part of everything else unless it is asked to. ClamWin is a scanning tool, and that's about it.

I have a powerful computer and can afford to use realtime protection, but I believe an opensource AV like Clam will dominate in the future.