Central Anti-Virus For Small Business?

rduke15 writes "I'm trying to find a centrally managed anti-virus solution for a small business network, which has around 20 Windows XP machines with a Linux server. It is too big to manage each client manually. However, there is no no full-time IT person on site, and no Windows Active Directory server — just Linux with Samba. And the current solution with Symantec Endpoint Protection seems too expensive, and too complex for such a simple need. On the Linux server side, email is handled by amavisd and ClamAV. But the WinXP clients still need a real-time anti-virus for the USB disks they may bring to work, or stuff they download from their personal webmail or other sites. I'm wondering what others may be using in similar situations, and how satisfied they are with it."

Comments

We use Nod32

[Mark19960]

It works well, you just need a windows server/workstation to push it to clients and for clients to get updates from.
It's also not very resource hungry.

I think 30 seats was around $1000

Re:We use Nod32

[JWSmythe]

I hear and find the same thing true with AVG. :) People bring me malware infested machines, so I uninstall AVG and install Avast Home (Free), which takes care of the problems, and protects them in the future.

    I'd highly recommend Avast. It does have a management tool which is what the article is seeking (avast! Distributed Network Manager). The server is free, but it requires a paid version of their software to use with it. Bulk pricing information is here: http://www.avast.com/eng/pricelist-avast-professional.html

Re:We use Nod32

[DEmmons]

we switched from AVG to Avast! also - our tiny nonprofit pretty much only considered the free options. I'm the only IT guy on staff and i'd been spending way too much time manually cleaning stuff that got through AVG using tools like Runalyzer and Spybot S&D. I don't remember any viruses getting through Avast! so far, and people bring in infected USB disks all the time (we're in the Philippines). Of course, we switched all workstations to Linux not terribly long after that except for the finance pc that needs to have Quickbooks and MS Office.

the only negative things I can say about Avast! are that the 'virus database has been updated' speech clip is annoying and almost gave my mother-in-law a heart attack once, and that it does make a noticeable impact on the performance on old machines (we actually still have pentium 3 boxes in use with 192mb ram). for a free product it does quite a good job.

Re:We use Nod32

[bflong]

We did something close to this, actually. We run Linux on all our workstations (with NFS shared home directorys). Then we run VirtualBox with immutable hard drive images. Every time Windows is closed, all the changes made to the system are thrown out. All documents are stored on the server. When new software or updates are needed, the administrator can run the VM with a changeable disk.

Now we're almost completely weaned off of Windows. The VM's are hardly ever used.

Sophos

[nevhan]

Both my university and workplace (of similar size to yours) use Sophos. They provide a number of centralised management tools, centralised update servers etc. Check them out, www.sophos.com.au.

Kaspersky - Support for Windows & Linux

[Swampcritter]

Kaspersky Enterprise Space Security is comprised of components for the protection of Linux and Windows workstations, file servers and mail systems.

Samba File Servers are also fully supported!

More Information -- http://usa.kaspersky.com/products_services/business/open_space_enterprise.php

Re:ClamWin

[Anonymous Coward]

From clamwin.com website:

Please note that ClamWin Free Antivirus does not include an on-access real-time scanner. You need to manually scan a file in order to detect a virus or spyware.

This assumes that the users remember to scan everything before they run.
(I personally do the clamwin thing for my personal machine, haven't found anything yet)

Re:NOD32 Antivirus and NOS32 Remote Administrator

[RudeIota]

NOD32 works fantastically well, although the licenses are comparatively more expensive when compared to some of the competition that's in the 'same league' (Eg. Kaspersky)

I haven't used the remote administrator to manage NOD32 clients (We don't have enough here), but after scanning thousands of PCs, I can vouch for the quality of NOD32. It's anecdotal, but I concur with many of the online results which show NOD32 has near-perfect detection rates and very low false positives. We keep trying different scanners, but NOD32 seems to do the best job.

mcafee

[fearlezz]

In my personal experience, I found mcafee asap (mcafeeasap.com) the easiest to use in such a small business. This software has "agents" which report their status back to the mcafeeasap.com website, from which the administrator can monitor all pcs.

This idea is great for small companies. The implementation however had a few problems:
- Over time, I've installed all "agents" at least twice. They just stop working for no reason at random moments
- Some agents 'do' have a reason to stop: they think the license has expired, while it's definitely not.
- And mcafee is bloated + it uses mshtml for every single dialog and even for invisible actions like downloading updates. This eats cpu power.

AV-Comparatives Corporate Report

[Ralish]

AV-Comparatives recently released their May 2009 Corporate AV Report, which sounds like it may be right up your alley.

It's fairly large, but reviews a large number of AV products with a corporate focus, contains lots of screenshots, and even grades them on their appropriateness for Small, Medium and Large networks. Sounds like it would definitely be worth a look in your case.

Get a proper AD server

[Toreo asesino]

...then use group policies to push out AV updates automatically & lock down the desktops remotely and automatically. Samba is a half-cut replacement for a proper Windows Server when it comes to Windows workstations (sorry samba guys; samba is good, but ultimately lags far behind what it's trying to imitate)

Windows XP is only really so vulnerable to viruses because normally it runs in "everything as root" mode; which, if you had a proper Windows server you could change in seconds (not that you couldn't do this manually, but with AD it's automatic network-wide).

Re:Start with sensible policies.

[mlts]

For a school setting, (and this is IMHO, so take it for what its worth), I highly recommend these tried and true protection mechanisms for a lab:

1: DeepFreeze with the enterprise console to allow updating when the lab is closed to the public or students.
2: Physical case locks.
3: BIOS set to disallow booting from anything but the hard disk, and each box set with a different password (the list kept somewhere safe)
4: An enterprise version of Norton Endpoint Protection configured to delete hacking tools (so someone can't load a popular serial number recovery program and have the organization's volume license keys to Office and other utilities.)
5: 1-2 cameras on the lab.

DeepFreeze isn't a silver bullet, but it at least makes people take an effort to bypass, even if they have administrative rights. The best advantage of this setup is that you can give users admin access to install whatever chat programs they use during a session, then a reboot cleans all their crap off.

Re:Start with sensible policies.

[fostware]

First line of defence?

Group policy (Software restriction policy) disallowing execution of code from anything but the windows (excl %temp%) and program files directory. Including dvd drives.

Closest kids get is embedding applications within Word, or debug modes of VS.