Re: Malware (antivirus) software for Macintosh

["Jason C. Belford" <jason.belford () OIT GATECH EDU>]

We provide McAfee VirusScan for Mac to our campus.  A co-worker of mine prefers Sophos.  He ran some (unscientific) 
tests by installing various clients and copying files around.  He timed each copy..  He shared his findings with me 
(see below).  

> I used a copy of my Library folder since it's 3.08 gigabytes and contains 32,819 files.  I figured more files to scan 
> will give me a better idea of performance.  I disabled Time Machine and rebooted the Mac between each test copy so 
> the environment was as nearly identical as I could make it for each run.  Each test was in a terminal window with the 
> command:
>
> time cp -pr Library-test/ Library-test-2
>
> First, I did it twice with nothing installed.
>       
> Real          User            Sys
> 1m38.032s     0m0.998s        0m12.907s
> 1m40.936s     1m0.008s        0m13.119s
>
> Then twice with McAfee installed.
>
> Real          User            Sys
> 4m14.581s     0m1.196s        0m15.959s
> 4m12.333s     0m1.198s        0m16.052s
>
> Wow!  Over 4 minutes!  Then I uninstalled McAfee and ran the test again with nothing.  I should have gotten similar 
> results to the first two runs.
>
> Real          User            Sys
> 1m42.203s     0m0.996s        0m13.060s
>
> Yep, similar results.  Then I installed the free version of Sophos for the Mac and gave it two runs.
>
> Real          User            Sys
> 2m26.733s     0m0.985s        0m14.081s
> 2m26.177s     0m0.978s        0m14.062s
>
> The extra overhead of scanning 32,819 files added 44 seconds to the copy using Sophos.  Using McAfee it added 2.5 
> minutes (150 seconds)

I am only presenting the facts and this email should not be interrupted me as endorsing any product.

--Jason


On May 17, 2012, at 3:45 PM, Cappalli, Tim G @ LSC-OIT wrote:

> We are using McAfee on the Macs with no noticeable performance issues. We just moved our Windows machines to FEP.
>  
>  
> Tim Cappalli, ACMP CCNA | (802) 626-6456
> Office of Information Technology (OIT) | Lyndon
> » cappalli () lyndonstate edu | oit.lyndonstate.edu
>  
> <image001.png><image002.png><image003.png>
>  
> From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Dean 
> Williams
> Sent: Thursday, May 17, 2012 3:18 PM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: [SECURITY] Malware (antivirus) software for Macintosh
>  
> A rash of Flashback infections has us thinking about malware protection for our Macintoshes.  Is anyone using a 
> product that you’d recommend (or recommend against!)?   If you are supporting malware protection for your 
> Macintoshes, is the impact on system performance acceptable?   Is it effective in preventing or at least detecting 
> infections?  Are updates timely?  Is it affordable?  
>  
> Thanks for any experience or insight you can share.  
>  
> Dean Williams, GSLC     
> Information Security Officer                             
> Enterprise Technology Services      
> University of Vermont
> Dean.Williams () uvm edu | 802-656-1174 
> http://www.uvm.edu/it/
>  
>  
>  
>
>
>  

--
Jason C. Belford, CISSP, GCIH, GCFE
Principal Information Security Engineer
Office of Information Technology
Georgia Institute of Technology
Phone: (404) 894 - 6159