27 Dec 2007, 11:52 am
27 Dec 2007, 4:00 pm
27 Dec 2007, 5:08 pm
Bah! Hit a mouse button and lost what I was typing.
So I'll be a bit more conscise.
1) McAfee has more than it's share of problems as well as a much lower detection rate. In the past uninstalling has formated your hard drive for you.
2) Symantecs non AV engine applications in the past have been dreadful. I'd never have reccomended them to anyone.
3) Their new product is a quantam leap forward and just plains works.
4) Startup list is an entirely different beast than either hijackthis or spybot. Hijackthis lists everything that hooks into your web browser. Spybot is an application that scans based on signatures for malware on your system. Startup list gives a dump of everything that your system loads at startup. In conjunction with everything else; it helps tracking down those last vestiges of some malware that wants to sit around.
5) I base my numbers on keeping track of about 5 or 6 different sites that test AV programs and keep a spreadsheet at work. I also do my own testing with about 10 different apps every quarter.
6) Yes, I currently run a large network but I cut my teeth as a home consultant for years. I have a series of articles written, that I'll post someday, that are meant to help those sys-admins in small and medium businesses get the most bang for their buck. Most everything is marketed towards large enterprises that have $$$ to throw around; not us little guys who have limited funds and time.
7) If all you're using is McAfee and a hardware firewall; you're in for a world of hurt. I know I'm paranoid but it's kept us clean for a couple of years now. I use a hardware firewall backed by a software firewall before getting to the outer network. On top of that; all email is scanned 4 different times by 3 different AV scanners before it gets to the user. In a business, you have to assume everyone is a moron and will open everything. At a home, you can base it on the user.
I used the download.com link because it's a bit more familar to people. I agree that going directly is normally the best case. And personally only go to safer-networking.org myself.
9) The biggest problem with av-comparatives is that they only ever test the commercial home user versions of everything. The enterprise apps are an entirely different beast more often than not. Also, if you trend their results; you'll see that Kaspersky and Symantec score near the top in every report while others are a bit more hit or miss. I'll take a .5% drop one month to stay at the top month after month. 
10) As for grisoft and other free scanners; I state this from personal experience in that I setup a small farm in my apartment and installed grisoft, mcafee and symantec (sorry, I did 3 more but forgot which they were). Left them open to the internet and then logged what happened. (all were virtuals so I could control the baseline to make sure everything was the same and reload them to base if crap happened). The old saying, you get what you pay for is quite often true at least with AV Scanners.
27 Dec 2007, 5:35 pm
We use a hardware firewall on the network - it's fairly aggressively configured.
We have software Firewalls and AV.
All our inbound/outbound mail is scanned by a battery of different scanners.
We don't use outlook or exchange (yay --- that gets rid of half the viruses anyway) - we use Lotus Notes/Domino which doesn't permit the same level of viral interaction.
How do you get time to test all those scanners... do you have a large IT department? I'm basically the IT department, though I now have a 2 day per week helper. We only have about 28 internal people to support but we also look after 1200 externals and a couple of hundred databases. (and I do a bit of development too).
No time to get things perfect.
27 Dec 2007, 5:46 pm
It's my life.
We have a full time developer and I've a full time helper who does vertical application support which leaves me pretty free to handle everything else. I'm normally working 10+ hour days and go home to more testing and research. I've an internal support burden of about 80 people with 1000+ externals. I only have 30 or so DBs but it encompasses multiple terabytes of information. (last I checked I had over 40 TB of storage being used)
Remember --> Aspie. Computers have been one of my "things" since I switched over from dinosaurs at age 6. hehe
The greatest thing though for testing is Virtual Servers. I can't say enough about them. Get a VHD file with your OS... make copies of it and load up a bunch of different virtuals; install what you want on each and let them go.
Now; I'll probably say this a hundred different ways in a hundred different posts but it needs to be said.
It doesn't matter one little bit one OS/Mail/Server/etc that you run. The principles and operation are the same. The screws needed to screw in the nuts may be slightly different but you still need to attack each process in the same manner. You can never assume just because such and such OS hasn't had a virus this month that it's safe. Mac fanboi's are the worst of the lot. "I don't need an AV scanner because I have a Mac." (or insert your favorite Linux/BSD/UNIX/etc OS into that same line) Remember, the very first in the wild Virus was for UNIX. There are POC virus against every OS all the time.
The developers get all the glory because people see what they do. Security folks are only ever noticed when they fail.
27 Dec 2007, 5:57 pm
27 Dec 2007, 6:13 pm
29 Dec 2007, 12:46 am
