Anti-Virus HELP

[sdrtvl]

I can't believe it's come to this, I hope someone here can help.

We have a 12 PC, 1 server laboratory that IS NOT internet capable. I've been asked to get an AV program just in case a threat comes in on a CD, flash drive etc. All we need is AV, no need for spy or malware protection.
Some of the more common AV packages are just to much of resource hogs to be considered.
I've tried several others. In every instance either they wanted to go online for updates, wanted to be centrally administered and/or they failed because although the "definitions" updates were on the server, the program just would not work without going online.
I know how crazy that sounds, but I've spent weeks working with 3 different companies (one after the other) who suddenly realized their software would not work in our environment.

Any suggestions would be greatly appreciated.

Regards,

Dave

 

[silverhairbp]

Have you looked at the update options for AVG? I recall the option of getting updates from a server rather than ET phoning home to the mothership.

 

[cajuntank]

AVG will work like most others in that you can define a "server" for the clients to go get updates from. In some of the customization, it lists the server, but lists the update servers from grisoft as well as backup. I assume you could remove those so that it has but one location to look at (the server only). I believe you can also set it for the server to get it's update from a file manually instead of the Internet. Grisoft gives you a 30 day trial period of their software and it is very resource usage friendly.

You said that the lab is not Internet capable so you either have to give Internet access to the server alone, or you have to "sneaker-net" the update file(s) over to the server manually every so often. Yuk!

If you decide on AVG, I would suggest purchasing from one of the distributors listed on Grisoft's web-site. While Grisoft offers 24x7 support, it's email based only. The distributor I purchased from also offers me phone and remote assistance support (I can still do the email support with Grisoft if I so choose). They even remoted in and helped me install the software with all the tweaks.

Hope I could help and good luck.

 

[sdrtvl]

Greetings All,
The "local server" option in AVG has to be centrally administered and in the end, was still a problem the support team couldn't remedy.
I mean no-disrespect to AVG or the new "local" support folks, but after two weeks of working with the AVG support team, I finally gave-up when they suddenly realized it wouldn't work in the environment I have, it's a very long and involved story.

Keep in mind they can't "remote in" no IP connection.

Thansk,

Dace

 

[gb0mb]

http://www.clamav.net/

Look at clam-av. I am 99% sure you can download the updates and bring them into your lab.

Gb0mb

........99.9% User Error........
Ubuntu -- African for I can't install Gentoo

 

[sdrtvl]

gb0mb Thanks,

I've looked at "clamav", but until it can do automatic scans and updates (even from a local server) it's too time consuming.
I do check the Clam website waiting for more automation.

btw, is that a ham call?
Regards,

Dave

 

[gb0mb]

no not a ham call. Just a nickname I have had forever.

Take a look at anti-vir.

http://www.free-av.com/

I use it for personal use and never have tried it beyond that.

It consistently beats Symantec products for scanning. It seems Symantec drops virus definitions (signatures) after a certain amount of time. This product does not.

Gb0mb

........99.9% User Error........
Ubuntu -- African for I can't install Gentoo

 

[buitenhek]

I think you might like Deep Freeze from Faronics. It locks a copy of the PC image in memory. The user can access any program or software they bring in through zip or thumb drive. As soon as they turn off their PC, their system resets to the old PC image.

It is centrally setup/managed but used distributively. And each PC does not need to "updated" daily to stay current. Check with them regarding lab discounts et al.

http://www.faronics.com/

Regards
Peter Buitenhek
ProfitDeveloper.com

 

[cajuntank]

I use Deepfreeze on over 1500 stations and it works GREAT for what it does. Before starting here, the mentality was that they did not need antivirus on the pc(s) since Deepfreeze was on it. All that had to be done was reboot the pc(s) infected and everything would be ok. WRONG!!!

Deepfreeze does not stop virus or spyware from infecting a station. Yes, rebooting the pc will get it back to a pre-defined configuaration; however, before doing so, the pc is
infecting other stations, throwing trash on the network, causing headache. Rebooting hundreds of stations all at the same time to make sure the virus doesn't propagate further is a monumental task in our network.

Now that being said, with you only having 12 pc(s), you could handle this a lot easier than I could.

There would be some logistics to work through like, do you Deepfreeze the stations but not the server (if a station was infected and passed that on to the server, then you could reboot the station, but the server would still be infected and possibly continue a cycle of infecting back the station(s)). I guess you could Deepfreeze the server, never used that product before, so can't give an opinion on that one.

Maybe a compromise between the two (antivirus and Deepfreeze) so you wouldn't have to babysit the updating of the virus def's so much.

 

[gb0mb]

I thought I had mentioned Deep Freeze but I guess I didn't. It is great when dealing with students. As stated above not an answer for having AV.

Gb0mb

........99.9% User Error........
Ubuntu -- African for I can't install Gentoo

 

[buitenhek]

The initial direction for Dave was to get a virus product --just in case. The problem was limited to no or limited internet access for updates.

I think cajuntank's recommendation is sound in that you use a basic 1-time virus program to set your baseline, and Deep Freeze the rest. QED.

Regards
Peter Buitenhek
ProfitDeveloper.com