AntiVirus Software for Family History Center

[techgy]

Pctools.com has a free anti-virus package that can be downloaded and used without restriction or limitation. It may not be top of the line, but something is better than nothing. Might be useful to check it out.

[danpass]

Someone may suggest a free anti-virus, but in reading the licensing, I see "If you are not a home user or if you use your computer for business purposes, avast! Home Edition is not licensed for such use" and "AVG Anti-Virus Free Edition is for private, non-commercial, single computer use only". Those aren't the only Free AV out there, but it's the two I hear most often recommended.

Disclosure: I'm an avast! affiliate. Please don't view this post as my trying to sell something or get financial gain. My affiliate id is not posted here and if anyone chooses to purchase the product, there is no benefit that I would receive. Also, this is a personal recommendation, the LDS church does not endorse this product.

I've been using avast! Professional and recommending it as well as the Home Edition when appropriate for close to 6 years. I have installed it on many new computers for clients and also replaced other anti-virus products on computers that got infected even though they had current versions and updates from the vendor of that product. To my knowledge, none of these systems protected by avast! have been compromised by viruses or malware.

While not free, avast! Professional is relatively inexpensive, particularly if you buy multi-year licenses for multiple computers (3 year license for 2-4 computers is $21 per year, per computer). The license can be transferred to a new computer and includes program updates (new versions and releases as they become available) as well as definition updates.

Here is a comparison between the home and professional versions.

For home and home business situations with multiple computers, they have a new Professional Family Pack license that allows you to install it on up to 10 computers at a single location for a low flat price.

Their web site also mentions that discounts on avast! Professional are available to non-profit organizations.

[russellhltn]

Just to add-on here. I usually don't see a lot of benefit to anti-virus. (It's been months since I've seen an alert trigger.) The threats to computers have shifted to the Internet. Some packages have made the shift. Some haven't.

To protect the FHC I manage, I do the following: Run Patron as a "User" (sometimes called restricted user). That alone limits what any malware can do. I also run Spybot - Search and Destroy as well as Spyware Blaster. I've never had a problem. Maybe our patrons are just well behaved.

[jdlessley]

Maybe our patrons are just well behaved.

That may be true. We are not so lucky and having anti-virus has saved us from a lot of infections.

[Mikerowaved]

The problem nowadays is not necessarily the user going to bad sites and letting in malware, but now many known "good" sites have been hacked with malware "land mines" injected directly into the host's web page for the unknowing surfer to step on. Although Spybot S&D and Spyware Blaster are great products that I use myself, they don't have the instant protection that a good AV product can offer.

BTW, I've used Avast! and although it works very well, I really don't like any of the skins it offers. I like things simple and spelled out so I don't have to hover over an icon to get an explanation of what it really does.

[russellhltn]

That may be true. We are not so lucky and having anti-virus has saved us from a lot of infections.

Keep in mind that by default "Patron" is a "Power User" with the ability to install software. I have them run as "User" which has very minimal install ability. As a result, most malware simply can't take up residence.

[russellhltn]

Although Spybot S&D and Spyware Blaster are great products that I use myself, they don't have the instant protection that a good AV product can offer.

While Spybot S&D has a scan function, it also has real-time protection. If activated, the "tea-timer" is really "aggressive" asking for permission for most any change to the registry. And if you don't have "block bad pages silently" for the main product, you're likely to change that setting within a few days of normal use.

I'm not sure what all Spyware Blaster does, but I understand it limits the function of Active-X.

So I'm not sure what you mean that these programs lack "instant protection".

One of my issues with Ad-Aware's free version (besides the fact it's not free for non-profit use) is that it's only a scanner with no real-time protection (last I checked).

[techgy]

The Firewalls for an official FHC permit more access than the firewalls for the Meetinghouse Internet which we're in the process of setting up. As already discussed here in other forums, many have discovered that these Meetinghouse Internet firewalls are fairly restricted - even the enhanced version. I mention this because these firewalls provide a reasonable protection against picking up an infection by the fact that they inhibit your access.

We take this one step further and all workstations in our "unofficial" FHC are directed through a local proxy on one of the computers. We do this on a peer-to-peer network and use one box as the "server" although it's only running the same OS as the workstations do. This "server" hosts the proxy software "FreeProxy" which we have all Email restricted. It works perfectly. By preventing access to Email and through the additional help of the firewall user are kept within some tight bounds that helps to prevent infection.

[jdlessley]

Keep in mind that by default "Patron" is a "Power User" with the ability to install software. I have them run as "User" which has very minimal install ability. As a result, most malware simply can't take up residence.

I agree and disagree. While a limited user cannot install programs it does not mean the malware is not on the computer waiting to be installed. Trojans, worms, rootkits and others do not need to be installed immediately to do their damage. Since we keep the temporary internet files for 30 days to monitor internet usage (Required by the Church's Family History Center Internet Use Policies. The number of days is a local determination.) on the computers, the potential for infection is there. Another source is the Patron user desktop. While I have locked access to the Patron user to change (add or delete) icons, rogue icons appear as "drive-by" installs from web sites. Most of these malware attempts to get their foot in the door are picked up by the anti-virus program and blocked. Without the anti-virus software the potential for infection goes up dramatically. While investigating use of a FHC computer to access inappropriate web sites I was caught by a Trojan simply because I had to view the temporary internet files directory contents with administrator privileges. This was one piece of malware the anti-virus did not catch until I inadvertently activated it by viewing a file's properties.

[russellhltn]

Trojans, worms, rootkits and others do not need to be installed immediately to do their damage.

But they have to be run by someone with higher privileges to do their dirty work.

While I have locked access to the Patron user to change (add or delete) icons, rogue icons appear as "drive-by" installs from web sites.

How are you locking this? It sounds like a lock at the user interface rather then at the file level.

While investigating use of a FHC computer to access inappropriate web sites I was caught by a Trojan simply because I had to view the temporary internet files directory contents with administrator privileges. This was one piece of malware the anti-virus did not catch until I inadvertently activated it by viewing a file's properties.

Which suggests that maybe it would be a good idea to set up a second user with the privileges needed to browse the Patron files but without having admin rights.

I'll have to check the machines, but I don't think the AV has triggered at all. Which means I'm either got really well behaved patrons or I'm somehow stopping them before the AV can get to it. And since AV by nature is aways requires someone to get sick before there is a cure, I think that's a good thing.