Best Industrial Strength Anti-Virus Software?

In Compaq's testing Antigen was the top rated AV product... and I've spoken with developers and reps from Sybari several times and always gotten good vibes. On the Compaq ActiveAnswers website their AV whitepaper is available for download.

There's also a fairly extensive listing of the possible AV solutions for Exchange here: http://www.mail-resources.com/resources/search.cgi

All of the products have advantages/disadvantages.. there is no single best product per se (at least IMHO)... the best one is the one whose features best meet your needs and whose issues cause you the least amount of pain.

Thanks. I assume you work with Compaq and not Antigen. I msut add that if someone works for a anti-virus publisher, I would like to know that. People like to tout their own products.

 lso if someone works for a company with >10,000 people with over 3k desktops, this is good to know as well.

Thanks, Peter

Thanks for the above, I will take a look at the link.

Are there any Anti-Virus packages that we should not look at? (Computer Associates, Mcafee/NAI, Trend Micro, Sybari, Symantec, etc....)

Peter

Anything but Macafee. Every day we have users getting "corrupt DAT file" message, "need to reinstall" message, or the service fails to start on NT. So, so weak.

What about Innoculan??? All these questions relate to Exchange/Outlook integration for AV
Thanks, Peter

I wouldn't put GroupShield within a hundred miles of my Exchange server, and I don't think the Outlook client itself is a good place to fight viruses... a desktop client sure, knock youself out and use whatever you want, but if your Exchange server is already being server product, to rescan it using a client is a waste of resources IMHO.

My shortlist is Antigen and Trend.. maybe Norton as well.

Funny, I tried Innoculan and this failed to work with our system, in so much that it failed to stop the lovebug from going out or in.  I ripped it out and installed McAfee group shield and it worked perfectly from the start.  You must be at SP3 with the store hot-fix in order for it to work.  We have had it in place for over three months without error.  The nice piece is that the server is only a connector server, but we also have it on our mailbox server and both of our Notes servers and it works fine.  Just don't let someone try to apply the superdat to it.

soulmagus: I agree, we use GroupShield and it works fine. It's caught the only virus we ever got sent in an E-mail since it was installed, so I guess that's a 100% success rate!

Guess, you will get pros and cons for nearly every product. We are using Norton, >1K users, 10 countries.
pjknibbs: can it be, it was the only one it caught ;-)

schmiegu: We haven't seen any signs of virus infection internally, and nobody we send E-mails to has complained we've sent them a virus, so I think we're as clean as can be expected!

pjknibbs, it was only a joke, initiated by the secureness you stated: 1 Virus caught, 100% success. I like McAfee (NAI) myself and I won't let another product on my workstation. And it is integrated in our Proxy and Internet Mail Scanner (the CSM product).

I would appreciate if a few people could  rank the following in their AV protectivity at the server level? Keep  Microsoft Exchange in mind. Thanks, Peter

Inoculan
Trend Micro
Sybari
Macafee/NAI
Symantec
FSecure
ThunderByte
Sophos
Panda
Norman
etc...

I agree with you on GroupShield (I shouldn't say this, but I will).  I was a tester for NAI while this product was being developed and I was shocked at how poor the product is.  If you make a mistake installing and uninstalling it you are looking at a rebuild.  The reason for this.

'There was no Specification for this software.'

'It was written by ONE person, who then left and did not document any of the software.  The developers where pretty much working blind and did not know what most of the software was actually supposed to do'

'I found a few major bugs/security holes and was told not to mention or document them any futher as they would not be fixed.  I discovered a Major bug with the quarantine folder that leaves your system open to undetectable virus attacks.  I know how to send a virus to a NAI protected exchange server and it will choose to ignore it. (If I can work it out, so can anyone)

I would Rank AntiGen as one of the best.

Trend is ok but difficult getting results if you have problems.

We you to run Innoculan here we out any major problems, although we had problems with viruses in the Public folders (which there are a lot of here).

I agree with cscharff recommendations.
AntiGen and Trend, steer clear of NAI.

Any idea on Sybari or just not used as often?

Thanks very much everyone. I appreciate the great dialogue.
Peter

Not much experience, the problems we encountered with Sybari was very poor support, they did not seem to know the product atall and could not give any answers to our problems.

Antigen by Sybari is great.  I haven't had to deal with their support crew, but the product itself installed flawlessly and takes care of itself.

Incoming and outgoing virus attachments can be intercepted and cleaned or deleted.  

E-mail notification can be sent to specific users notifying them about a variety of info such as the recipient or sender of an infected message, type of virus, filename, etc.

pacumming,
I can solely speak from personal experience. We installed NAI's Groupshield without a hitch. We have Exch. 5.5 SP3. It's worked great and detected every single virus we've received and we've gotten several hundred since installing it. I really love it, I have it setup to go out and download updates from NAI regularly and also set so I get notified everytime a virus comes in. It's been completely hands off except for when I changed the notification when I went on vacation :-)

We have NAI's Total Virus Defense Suite, NetShield is installed on our 4 other NT servers and we have the regular Virus Scan 4.0.3 on all desktops w/ the options for internet and local system detection turned on.

mds32767's comment about corrupt DAT files I find rather misleading. We have experienced this "problem". When a desktop user updates, if that update requires a reboot to complete then McAfee's command line scanner halts with a "corrupt DAT file" message. This is normal because the update needed a reboot to complete and hasn't finished yet, but the command line scanner isn't sophisticated enough to understand this... If the system is rebooted a second time there is no error. We simply clued in our user's to expect this when they update and reboot, just hit enter when it happens.

Just my biased $0.02

Good luck,
Jhana

Thanks, anyone else like/hate the NAI products??

I thought Expressions comments were interesting. I do not doubt that such development occurs.

As for Mcafee, I can speak as a personal home PC user . Would not use it if they threw in $1,000 with it. I bought it and tried to use ot for 2 years.. I think its connectivitiy to download updates, to be polite "rots".
Norton AV updates perfectly everytime. I was on a 56k modem for a while and then on RoadRunner and either way-when I had Mcafee, it still had timeouts during the download of updates..

But again, that was for personal use outside of my original question.



Peter

pacumming,
It's always so interesting to hear people's different comments, so much depends on your specific situation. I had nothing but problems w/ Norton on the few workstations that we used to have it on (don't recall the ver.) and MCAfee 3 was weak.

Expressions,
I wasn't going to go here, but since pacumming mentioned it I will. I find your comments unbelievably irresponsible. If there *is* a security hole, report it to ntbugtraq.com, ntsecurity.net or any one of the other myriad of security groups, so they can put pressure on NAI to fix it. *If* it even exists. Just how long before the product release were you testing? How come no one else has figured this out? Please, send me a virus and I will post here if GroupShield detects it or not. I think the life stages one would do just fine, I have plenty of quarantined copies if you need one ;-) My email is jbrown@aurasystems.com

Jhana: In tested right up until the product was released and a few service packs into it.

NAI work on the basis of they have a set deadline, if the product isn't ready tough, they are going to release it anyway.  As for irresponsible, if you ever worked for one of these companies you may understand.  NAI GroupShield lt can work great, it depends a lot on the setup of your network/servers.  I got it running with pretty good performance on a Pentium 120 with 32 MB Ram and had no problems.

I like the way GroupShield works compared to some of the other Exchange Virus Scanners, but I have seen far too many big problems.  As the developers said, the next version will be much better, which I believe is true.  I know the product fairly well and I actually wrote some of the manual and have written a few white papers for NAI.  The developers where on a loser for this product as they were forced to work with someone elses code and meet unrealistic deadlines (which they well, although most of us ended up working in excess of 18 hours on some days).

If there products works well for you, then great, but this is more likely to be because your NT Servers have been installed well in the first place.  Most of the testing was done on either clean installs of NT or installs that were problem free.  In instances when this wasn't the case there was usually fairly major problems.  GroupShield working well for you is probably more down to your server being well setup and maintained.

Most NAI products I like, NetShield is good, and some of the desktop and server scanners are good.  To be honest, you should never rely solely on 1 companies virus checkers anyway.

As for the problem with the product, it is more a hack than a bug.  You need to know the product pretty well to get it to work.

Well we use Norton Antivirus Corporate Edition Ver 7.0 and it is quite good it has Exchange Server Protection even on the desktop and this protect mail from the client side which may orginate from a floppy  or other removable devices.

The Exchange Server Protection is okay and I have been having problems in getting the fulll SMTP options it gives a message - well I will be posting this issue soon -  But the drawback is that the current version will only work with Exchange Server SP2 tried with SP3 and bingo the NAV for Exchange crashes.

Also please note that if you have
middle eastern language to support be very careful. Earlier versions have crashed the OS not the fault of NAV but they took some time to pinpoint to problem for us

We're using NAV for exchange and it has been problem-free. It auto-checks for updates every three days, and sends out notifications if it finds anything.