Virus scan software

Yes, you should run a different scanner at your gateway. If a virus makes it past your gateway, hopefully the other vendor has an eye ready for that virus and catches it. If the exhange server receives mail from outside untrusted sources, it should have at least 2 different types of scanners on it or hosted up stream from it. One is obviously a virus scanner and the other a mail filter. The mail filter can be coupled with a url filter as well, providing better protection from malicious sites.

If you do not put something on that exchange server, it is just a matter of time before something bad happens.

Keep your onion layers thick and your policies should beable to define each layer and who owns them.

McAfee is no longer offering full support for version 4.
You can still update the virus definitions, but the engine updates are supposedly only for version 6 and newer.

Therefore, now is a good time to review and implement a new solution.

I would take a good look at Trend and Sophos, along with Symantec and McAfee.

I don't know that their is a 'true' benefit to different virus scanners at different locations.

Unlike a fire-wall, the strength of a virus scanner is how well the virusdefinitions are kept up to date. The more different virus scanners you have, the more time required to keep everyone up to date with the latest virus definitions.

Chas

We use Trend Micro OfficeScan and other components here. Not to impressed. Missed many hits, but my Computer Associates scanner picked it up.

Not all av progies are created equal. It is not how fast on av company supplies dats for new viruses, it is how well the scanner works. Computer Associates, in my mind has the best scanners, but I would still use Trend because both have missed hits that one or the other picked up.

Defense in depth, one program cannot offer that solution.

I am going to agree with most folks that multiple scanners are better. While in an ideal world one scanner will always catch everything suspicious, sometimes that's not the case. In that event you want another scanner as a back-up.

It has also been noted that most AV updates come out within a short time of one another, which is pretty much the experience I've had. However, I've also had experience where one of my client's automatic updates failed, which left them vulnerable for a period of time until the updates were finally applied. Had a new virus tried to take root in their system, they would have been in trouble.

The chances of two automatic updates of different products failing at the same time is slim (slimmer than one failing, certainly), thereby providing more protection. It costs more, to be sure, but it all comes down to risk tolerance (i.e., how far out on a limb are we willing to go to save a dollar?), which is going to be different for each company.

There's my $0.02 - no change required.

I agree with all the previous layered approaches. We have installed Trend on the Exchange server, Innoculan on the Novell servers, McAfee on all the Cisco products and Windows servers and use eSafe on the gateway. I think there are some servers that came with Norton, but they're going away. Innoculan is, too, since Cisco made us pretty much buy an enterprise version of McAfee to fulfill our contract agreement. But we'll keep Trend for the Exchange servers and the gateway scanner.

The previous powers of my firm went with the best application in each category, at the time.

Very interesting thoughts on using the layered approach versus going with the same vendor all the way.
Pros
- Most vendors use the same dat/definition/signature file for all their products. One file equals all updated products
- Less expensive for support costs when you use one vendor
- Most vendors have gone to a single management solution for all their products.
Cons
- If they don't have a pattern for a virus you could be vulnerable at every layer
Okay, so I can?t think of any more cons.

Since almost everyone is giving personal preferences, I will include mine. I don?t think you can beat McAfee in the corporate environment and I will explain why. For one thing, their new engine gives them the ability to scan in memory. Bigwoop you say? Well this does set them ahead of the competition as being the ONLY AV vendor to scan processes running in memory. With this new engine, we were able to stop SQL-Slammer without having a dat and this is when their engine was still BETA. I have always used their highest level of support (Enterprise Prime Support) which gives me direct access to a dedicated engineer. I share this resource with only about twelve other accounts and have never been disappointed with the quality of service. Their management console (e-Policy Orchestrator) is by far the best and most advanced security management tool I think I have ever used. I have compared it head to head with CA, Symantec, Trend, and Panda.

As for product coverage, they cover every aspect of my enterprise. We have Macs, NT/2000/XP, Novell, NetApp, Linux, Exchange, and Domino/Notes. Every layer is covered with McAfee including remote users. We have never had a corporate outbreak but that could be because we have pretty strict av policies that are constantly being enforced. Thank you NAI and McAfee!

I welcome comments and feedback.

Protection system as stated by some of the postings here however there is an AV product that works a bit differently to the rest as it looks for strange strings rather than comapring the incoming data to already known Virus Libaries some of you might like to have a look see at

http://www.leprechaun.com.au/

It's worth a look see anyway.

Price - CA's aggressive pricing beats the competition:
http://www.informationweek.com/story/IWK20030303S0003

Quality - Thanks to the dual scanning engines, detection quality is actually one of the best (if not the top). The virusbulletin scores need a little work to evaluate correctly because you should combine the results for each engine (before Nov 2001) to get an accurate result
http://www.virusbtn.com/vb100/archives/products.xml