AntiVirus Software for Family History Center

Does anyone know where I can download antivirus software for my Family History Center. Can I use the same program we use on the Wark Clerk's computers, or would that violate a license agreement?

There is a policy and guidelines document on Family History Centers at Clerk.lds.org. It has instructions for anti-virus software downloads.

James_Francisco wrote:There is a policy and guidelines document on Family History Centers at Clerk.lds.org. It has instructions for anti-virus software downloads.

True, but those instructions are out of date. They refer to Command Antivirus from authentium.com, and the Church no longer has a contract with Authentium for anti-virus updates.

THe new anti-virus software is from Symantec, and is installed as part of the Desktop software distributed by the Family History Department. Note that this is a different version than the Desktop 5.5 used for administrative computers.

Go to remote.familysearch.org.

You must first install LANDesk. Then you'll noticed on the install screen a link to "Additional Support Files". You'll find Symantec AV in there. Other downloads are available via the LANDesk software.

Just to re-emphasize: Although both FHC and Admin computers use Symantec and LANDesk, they are run by different departments and should NOT be mixed between the two sets of computers.

Do as RussellHtn says about going to the "Family Search Suppport" site to get the latest version of LANDesk Manager installed. You can also get the Symantec product installed by clicking on the "Policy Based Delivery" icon in the LANDesk Manager folder in the Start menu once the latest version of LANDesk Manager is installed. This method will give you the opportunity to install other recommended and authorized FHC software. Be aware that the install of software using the LANDesk Manager requires you to monitor the progress and make inputs as each package is installed. There is a timer associated with the initial LANDesk Manager scan of the computer that requires user input to prevent the software deliveries from terminating.

jdlessley wrote:Be aware that the install of software using the LANDesk Manager requires you to monitor the progress and make inputs as each package is installed.

Before you install LANDesk, you probably should find out the FHC's unit number. Because it will ask you to identify what unit the computer belongs to. This is NOT the same as the ward or stake unit number. It usually starts with a '3' or a '4'.

We currently have a small center in each of our buildings in our stake. Each center has the Internet and we're in the process of expanding the Internet to the clerk's offices.

The admin computers in the clerk's offices are running the desktop software which includes the SYMantec anti-virus package. The computers in our FHC do not have this desktop software and in fact are not fast enough to support it without going to their knees

Could this same procedure be used for an un-official FHC in a stake or meetinghouse so that we could also make use of the Symantec package? We have Win2k Pro on the FHC computers.

Techgy wrote:Could this same procedure be used for an un-official FHC in a stake or meetinghouse so that we could also make use of the Symantec package? We have Win2k Pro on the FHC computers.

My own personal reaction is that your are in no-man's land. The machines are not administrative nor are they in an official FHC.

Give the Family History Department a call, but don't be surprised but what the stake will have to come up with something of their own. When you call, you may have to work your way past the service missionaries to someone who really knows. Be sure to ask any missionary for references on the answer. If they can't pull a knowledge document, then the missionary's advice is likely inaccurate.

Someone may suggest a free anti-virus, but in reading the licensing, I see "If you are not a home user or if you use your computer for business purposes, avast! Home Edition is not licensed for such use" and "AVG Anti-Virus Free Edition is for private, non-commercial, single computer use only". Those aren't the only Free AV out there, but it's the two I hear most often recommended.

Russell,

I kinda figured that was the situation. I'm aware of the "freebee" situation. Up to now we've used a proxy on one of the computers to control access to the Internet. It's works quite well and aside from that I suppose we've been lucky. With the recent release of the letter permitting the expansion of the Internet into the meetinghouse, we're pursuing things in that direction and I wanted to be able to add some protection to the FH pc's.

If anyone knows of a free package that would be legal to use in a church AND that the firewall (expanded access) will permit, I'd be interested to hear about it.

Thanks

We have a unit that has an unofficial family history center. They have called me on occassion to fix problems that arrise. Having a good antivirus is a must. They ended up buying a three license internet security suite for $60. I did a quick check on-line and the 2008 3 license products are available under $50 now - and even lower if you do a little shopping. Licensing restrictions and nussance advertising for some products are the big issue for freeware products.

Pctools.com has a free anti-virus package that can be downloaded and used without restriction or limitation. It may not be top of the line, but something is better than nothing. Might be useful to check it out.

RussellHltn wrote:Someone may suggest a free anti-virus, but in reading the licensing, I see "If you are not a home user or if you use your computer for business purposes, avast! Home Edition is not licensed for such use" and "AVG Anti-Virus Free Edition is for private, non-commercial, single computer use only". Those aren't the only Free AV out there, but it's the two I hear most often recommended.

Disclosure: I'm an avast! affiliate. Please don't view this post as my trying to sell something or get financial gain. My affiliate id is not posted here and if anyone chooses to purchase the product, there is no benefit that I would receive. Also, this is a personal recommendation, the LDS church does not endorse this product.

I've been using avast! Professional and recommending it as well as the Home Edition when appropriate for close to 6 years. I have installed it on many new computers for clients and also replaced other anti-virus products on computers that got infected even though they had current versions and updates from the vendor of that product. To my knowledge, none of these systems protected by avast! have been compromised by viruses or malware.

While not free, avast! Professional is relatively inexpensive, particularly if you buy multi-year licenses for multiple computers (3 year license for 2-4 computers is $21 per year, per computer). The license can be transferred to a new computer and includes program updates (new versions and releases as they become available) as well as definition updates.

Here is a comparison between the home and professional versions.

For home and home business situations with multiple computers, they have a new Professional Family Pack license that allows you to install it on up to 10 computers at a single location for a low flat price.

Their web site also mentions that discounts on avast! Professional are available to non-profit organizations.

Just to add-on here. I usually don't see a lot of benefit to anti-virus. (It's been months since I've seen an alert trigger.) The threats to computers have shifted to the Internet. Some packages have made the shift. Some haven't.

To protect the FHC I manage, I do the following: Run Patron as a "User" (sometimes called restricted user). That alone limits what any malware can do. I also run Spybot - Search and Destroy as well as Spyware Blaster. I've never had a problem. Maybe our patrons are just well behaved.

RussellHltn wrote:Maybe our patrons are just well behaved.

That may be true. We are not so lucky and having anti-virus has saved us from a lot of infections.

The problem nowadays is not necessarily the user going to bad sites and letting in malware, but now many known "good" sites have been hacked with malware "land mines" injected directly into the host's web page for the unknowing surfer to step on. Although Spybot S&D and Spyware Blaster are great products that I use myself, they don't have the instant protection that a good AV product can offer.

BTW, I've used Avast! and although it works very well, I really don't like any of the skins it offers. I like things simple and spelled out so I don't have to hover over an icon to get an explanation of what it really does.

jdlessley wrote:That may be true. We are not so lucky and having anti-virus has saved us from a lot of infections.

Keep in mind that by default "Patron" is a "Power User" with the ability to install software. I have them run as "User" which has very minimal install ability. As a result, most malware simply can't take up residence.

Mikerowaved wrote:Although Spybot S&D and Spyware Blaster are great products that I use myself, they don't have the instant protection that a good AV product can offer.

While Spybot S&D has a scan function, it also has real-time protection. If activated, the "tea-timer" is really "aggressive" asking for permission for most any change to the registry. And if you don't have "block bad pages silently" for the main product, you're likely to change that setting within a few days of normal use.

I'm not sure what all Spyware Blaster does, but I understand it limits the function of Active-X.

So I'm not sure what you mean that these programs lack "instant protection".

One of my issues with Ad-Aware's free version (besides the fact it's not free for non-profit use) is that it's only a scanner with no real-time protection (last I checked).

The Firewalls for an official FHC permit more access than the firewalls for the Meetinghouse Internet which we're in the process of setting up. As already discussed here in other forums, many have discovered that these Meetinghouse Internet firewalls are fairly restricted - even the enhanced version. I mention this because these firewalls provide a reasonable protection against picking up an infection by the fact that they inhibit your access.

We take this one step further and all workstations in our "unofficial" FHC are directed through a local proxy on one of the computers. We do this on a peer-to-peer network and use one box as the "server" although it's only running the same OS as the workstations do. This "server" hosts the proxy software "FreeProxy" which we have all Email restricted. It works perfectly. By preventing access to Email and through the additional help of the firewall user are kept within some tight bounds that helps to prevent infection.

RussellHltn wrote:Keep in mind that by default "Patron" is a "Power User" with the ability to install software. I have them run as "User" which has very minimal install ability. As a result, most malware simply can't take up residence.

I agree and disagree. While a limited user cannot install programs it does not mean the malware is not on the computer waiting to be installed. Trojans, worms, rootkits and others do not need to be installed immediately to do their damage. Since we keep the temporary internet files for 30 days to monitor internet usage (Required by the Church's Family History Center Internet Use Policies. The number of days is a local determination.) on the computers, the potential for infection is there. Another source is the Patron user desktop. While I have locked access to the Patron user to change (add or delete) icons, rogue icons appear as "drive-by" installs from web sites. Most of these malware attempts to get their foot in the door are picked up by the anti-virus program and blocked. Without the anti-virus software the potential for infection goes up dramatically. While investigating use of a FHC computer to access inappropriate web sites I was caught by a Trojan simply because I had to view the temporary internet files directory contents with administrator privileges. This was one piece of malware the anti-virus did not catch until I inadvertently activated it by viewing a file's properties.

jdlessley wrote:Trojans, worms, rootkits and others do not need to be installed immediately to do their damage.

But they have to be run by someone with higher privileges to do their dirty work.

jdlessley wrote:While I have locked access to the Patron user to change (add or delete) icons, rogue icons appear as "drive-by" installs from web sites.

How are you locking this? It sounds like a lock at the user interface rather then at the file level.

jdlessley wrote:While investigating use of a FHC computer to access inappropriate web sites I was caught by a Trojan simply because I had to view the temporary internet files directory contents with administrator privileges. This was one piece of malware the anti-virus did not catch until I inadvertently activated it by viewing a file's properties.

Which suggests that maybe it would be a good idea to set up a second user with the privileges needed to browse the Patron files but without having admin rights.

I'll have to check the machines, but I don't think the AV has triggered at all. Which means I'm either got really well behaved patrons or I'm somehow stopping them before the AV can get to it. And since AV by nature is aways requires someone to get sick before there is a cure, I think that's a good thing.

RussellHltn wrote:How are you locking this? It sounds like a lock at the user interface rather then at the file level.

Group policy - which is a user interface control and not a file level control. This is to control the user's from making changes to the computer. It does not prevent other sources from making changes. Therefore a properly written attack can install objects to any of the connected user's area of access (<user>My Documents, <user>Desktop, and so on). An example is a patron sees a graphic on-line and right clicks the mouse for the shortcut menu and selects Save as Background. The graphic is now saved as the displayed wallpaper for the user. --- Ooops, bad example. I just remembered I can lock that out too. Well I hope you get the idea.

RussellHltn wrote:Which suggests that maybe it would be a good idea to set up a second user with the privileges needed to browse the Patron files but without having admin rights.

Must have admin rights to access another user profile and the sub folders.

I'm just saying in my other posts is that having a good anti-virus is a very good idea if you want to protect your computer. Going without is risky business.

jdlessley wrote:Group policy - which is a user interface control and not a file level control. This is to control the user's from making changes to the computer. It does not prevent other sources from making changes.

There you go. I think you've answered your own question about where the security needs to be.

jdlessley wrote:Therefore a properly written attack can install objects to any of the connected user's area of access (<user>My Documents, <user>Desktop, and so on)

And then what? Typically things written to that area can only be run by that user. The user has very little power to alter the computer. Because, if something has the power to write those things it has the power to try and do it's dirty work. But it lacks the ability to hook into processes that start on bootup, so it has a hard time surviving a reboot. Not impossible, but I'd bet there's fewer Windows users running as "user" then there are Mac OS users. So which one is a virus writer going to work on?

jdlessley wrote:Must have admin rights to access another user profile and the sub folders.

By default, yes. But I'm sure that can be changed. On a WinXP Pro machine: Windows Explorer > Tools > Folder Options > "View" tab. Scroll down to the bottom and uncheck "Use simple file sharing".

Now, as admin, right-click the folder C:\Documents and Settings\Patron and grant someone else rights to see that folder. It may take a few rounds, but you should be able to get another non-admin to see the Patrons stuff. Likewise you can go into the Patrons Desktop folder and remove the Patrons ability to make any changes to the folder. Now it's going to take a lot more for anything to plop down an icon on the Patron's desktop.

jdlessley wrote:I'm just saying in my other posts is that having a good anti-virus is a very good idea if you want to protect your computer. Going without is risky business.

I don't disagree, and since the church provides it for the official FHC computers, I have no problem using it. I just don't consider it a front line of defense in a properly administered machine.

Thank you for the pointers. I am aware of the steps you mentioned and have used them - except I had to leave the My Documents open to the user for a place to store files. The problem is will my successor? Quite frankly I did lock down all the computers and used a semi-hidden user account to tie everything up. By doing so I became the only person who could make changes to the computers. Even our FHC computer specialist had to call me to make simple changes. Instead of making my job easier it added more work. After serious thought about what might happen after I was suddenly gone I decided to take another approach. I installed the Church provided DeepFreeze program and opened everything back up. With DeepFreeze it does not matter what happens to the computer. Everything is set back to the way it was following a reboot. Since there is a DeepFreeze OTSS to call at the BSD my successor will have someone he can call. The only thing I can't do is track inappropriate internet usage. But that's another issue.

jdlessley wrote:The only thing I can't do is track inappropriate internet usage. But that's another issue.

There may be a registry entry to point Temporary Internet Files to a unfrozen partition. That would solve that problem. In fact

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folder\Cache
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folder\Cache

looks like good ones to try and tinker with.

Thanks, I'll try that.