AV what are you using?

[irneb]

Im using NOD32 (ESET), there is a demo version on their site www.eset.com. Give it a try, I havent had any problems for the past 3 years. We use it and install it on our studio PC and clients PC cause it doesnt eat resources for lunch and it really works. Try and see

Thanks, I'll give that a shot on my laptop and report findings to the boss.

An AV that I found to be rather impressive for me is Comodo Internet Security. Not only is it free, but its one of only a few AV that gives you an free Internet Security Anti Virus. Been using it for a while now and with me working with clients and virus invested Flash drives, I've never had a problem since installing it

I've used Comodo before, and still like the firewall as it's a lot better than windoze own. Unfortunately it also tends to hog RAM.

Basically I'd say we need better PC's ... but the economy isn't exactly conducive to getting the best.

[tec0]

I take it; it is safe to assume that all your computers are running top end software “CAD� software. So every single computer must be a top line computer.

Still tell me why do you need internet on all the computers?

Secondly have you considered a standalone system like JUNIPHER or Packeteer?

There network security is second to none. Installation is not that expensive “considering what you are paying now� and its sits on your network not on every computer so it doesn’t do anything to your computer speed.

[irneb]

Easy to say! Unfortunately practically this doesn't work. I'd have loved having just that one program on a "clean" PC. 80% of our staff need emails in the daily course of their work, as the construction industry is coordination-coordination-coordination between various consultants ad-invinitum. Maybe just the juniors wouldn't need this, but I think out of 60 (in the SA office) there's 5 juniors.

And then about 60% of them would also require web access daily as they'd be searching for construction product information for specifications, sizing, availability, performance data, etc. Telling them you need to go to a designated PC / PCs would cause untold bottle necks galore!

Another requirement is FTP and Web access for up- and downloading of documents (most of our documents are in excess of 5MB which don't work well with emails). Depending on the projects we use our own FTP server, or if the client requests an on-line document management.

Even the presentation PC's require web access as 10-20% of the time the graphics artist is searching for images / photos which would fit correctly into the particular site / culture / demographic area / etc. We'd quickly lose our project if (say) we place a bikini'ed bombshell as a "livining" effect to the pool area if our client comes from Saudi!

And no ... it's not safe to assume our PC's are all top-end because we're using a "top-end" program. It's simply too expensive to keep on upgrading the hardware. For the past 3 years we have not upgraded our software (even though we are on subs) exactly due to the fact that the newer ACad's (from version 2009 upwards to the current 2011) are just not runnable on 32bit ... you can install it, but you can't do much! Some of our PC's can't even run a 64bit OS. So to install the newest ACad we'd have to fork out a few bar on hardware, just to get PC's capable of running it (just mid-range not top-of the line at all). And that would only cover our SA office, we can't have a new version in only one of our branches ... the file types aren't even compatible, and we constantly have projects spanning multiple branches! So it's more like 150 PC's to be upgraded.

Would these stand-alones work with web / ftp access? Would they allow for testing downloads before the client PC actually gets it? We do have a stand-alone firewall, but I can't see it testing everything. And what about CDs/DVD/Flash/etc.?

The emails "may" be possible through our internal email server. But due to the working of our international multi-office / mobile setup this just doesn't work. We've tried ... I know. Even through VPN it still didn't work, not to mention that some of the countries we work in don't allow VPN-like connections.

[tec0]

Would these stand-alones work with web / ftp access? Would they allow for testing downloads before the client PC actually gets it? We do have a stand-alone firewall, but I can't see it testing everything. And what about CDs/DVD/Flash/etc.?

Before you shoot me down with questions, I suggest you have a look at what these very powerful systems can do...

As for CDs/DVD/flash drives and other storage media, I take it that your company cannot be too bothered to set up a dedicated stand lone R2000 Desktop with a good antivirus on it to scan the media before it gets used in the office?

But honestly, I don’t know how you can secure your intellectual property if everyone can bring in and take out data as they see fit?

Honestly your company has more serious concerns then an antivirus at this point in time. The systems I have pointed out to you is really that good “expensive really expensive� but it is as close to 100% LAN and net protection as you are going to get. And it will solve most of your VPN problems too.

But your company have a serious “user problem� forget the antivirus! If people can move data in and out as they please then nothing on this earth is going to help your network.

My suggestion is start with the users.
Invest in a good security system like those that I have mentioned. (There are others available)

Scan all incoming media devices. “yes it is a bit of a drag but not all 60 people will have 32GB flash drives to scan all the time.� And if they do then your network is on borrowed time.

I really hope you have a good backup system. Because if 60 computers worth of data goes missing I really do not want to be IT dude working there! Active directory or even a good old Domain controller with permission control will help the situation and WILL protect your information “ up to a point�

but AVG is the least of your problems

[irneb]

Agreed! Although they're not as worried about intellectual property here as you'd expect from (say) a software company. And security is not as much a concern as with banks - except our financials are on a separate network with high security access only to select PC's & users. After each project our "intellectual property" becomes public domain anyway, seeing as any citizen may obtain it from the local council ... where we have to submit for approval before a building may be built. And all the consultants in the team generally use soft-copies of each others drawings in any case. It's a question of not being possible to keep our data secure & away from prying eyes. In that way it's a lot similar to the problems the Media have with pirating, we simply can't be bothered with trying to police the entire world - especially since we only get paid once per contract, and the "intellectual property" then actually becomes the client's worries.

We do use Active Directory & Domain, and all our data is stored directly on a server with a mirror server for daily backups. If the user's stupid enough to keep important data on their PC, they are warned that this is not backed up. Email backups are on an individual basis, through a passive IMAP server, so each user drags select project related emails to the IMAP folder as required. Otherwise the downloaded emails on their PC's are their problem. We can't run IMAP directly because of the usual email sizes we work with, e.g. I've received in excess of 2GB & sent 500MB since the start of the year.

Backing up: A weekly alternating external hard-drive backup on 3 copies (all at different locations) and a monthly archive to Blu-Ray discs (also 3 copies at 3 locations). Per office.

I'll take a squiz at Juniper & Packeteer as you suggest. Maybe it's a better idea after all.

I also agree with the portable media being a big problem, we have found virals which came from these ... unfortunately it's yet again a situation of business data flow requirements.

I know of one of our competitors who had implemented a system where they removed even the CD/DVD drives from each PC and disconnected the USB ports. Then had 2 PCS between 30 people for internet, CD\DVD & Usb. Their emails were still through each PC though. But after a year they saw that their productivity became so low that they started to loose clientele. So ... on the one side you have more control over your security ... on the other ... you go out of business. Which is more important?

And it's not just portable devices, it's laptops being used throughout the world remotely and / or in any one of our branch offices, or sometimes at one of the consultants' offices. So there's sharing at an incredible scale going on, not just inside our own controlled networks. You're correct that our IT is a nightmare!

[tec0]

Having 2 systems between 30 people is just bad planning. Having six cheap computers doing incoming media scanning only will help with infections. Remember you only have to do this once every morning while having your coffee. Most cheap computers can scan a flash drive within a few minutes. “Limiting the media too about 16GB� will help the situation.

Notebooks can take care of themselves, provided they are updated every day. If you have people running in and out of the office, then it is up to them to scan there media. Internet and LAN security can be handled completely by the systems I have suggested along with your VPN systems. It will secure your systems to the point where you can still get your mail, go on the net but FTP servers that has been blacklisted by your Administrators will not be accessible along with other “bad content� sights.

Limiting the user’s ability to install random software will also help the situation “again it comes down to what you need and what you don’t need� Just remember that you will still have all the permissions and abilities as needed but you will not have total freedom.

Selecting a good antivirus for your systems will require some benching. Take your slowest notebook and computer for the benching. This will insure that your solution will work on all your systems “most of the time�

[SilverNodashi]

We've been using AVG & Avast (both in the office, our personal PC's, and client & family's PC) for a long time with no issues. What you're describing sounds like a virus or trojan which could target AVG specifically.

Install Avast and run a boot time scan to clean it.

[KimH]

We use Microsoft Security Essentials on all our home pc's - free (yes something free from MS!!)
Works like a charm - here's the link if you want to check it out for yourself: http://www.microsoft.com/security_es...en-us#dlbutton

[irneb]

Thanks yes, as per my original post we've moved to M$ SecEss in combination with ClamWin. I've looked at Avast as wel, it seems really good! Not as great as NOD32 though, but close (especially for something free).

[irneb]

We've been using AVG & Avast (both in the office, our personal PC's, and client & family's PC) for a long time with no issues. What you're describing sounds like a virus or trojan which could target AVG specifically.

Install Avast and run a boot time scan to clean it.

Avast works awesome! It found a sshnas.dll with a Win32:Fake-AV-AVA[Trj] which none of the others could even see (AVG, ClamWin, nor M$ SecEss). Just strange that it's now been the 3rd time I had to register. It states that the registration expires somewhere in 2011, but that's what it said last time as well.

Also (not a biggy) anyone know how to turn off the notification that my email client is using a secure connection? I can't find anything about this in the Avast help. It only happens once per boot-up session, but why can't it figure out that I was happy with that the first time and leave it at that?