Virus protection without internet connection

Question

I am looking for an antivirus solution that does not require internet access to offer basic protection. Our customer's computers are mostly not connected to the internet, but vunerable to infection by USB Sticks or other media.

Are there antivirus solutions for this case, that do not require manual signature updates (which we cannot rely on, since our customers may be inexperienced with computers)?

Answer 1

There are great antivirus packages that heavily rely on heuristics, but mathematics alone can only go so far when battling malware.

If the computer to protect are networked then your best bet is to use some sort enterprise package (McAfee, Nod32, Kaspersky just to name a few) that allows you to use a local server as an update delivery server. That way you could load the virus definitions onto the server, and let the rest of the computers update their virus bases from there.

Another solution is to update the virus bases locally using a CD or USB drive on each machine, which, depending on the number of machines to protect, can be time consuming.

Another solution, if the previous two are not viable, is to disable USB and disk drives altogether.

Answer 2

I'd say no. Traditional antivirus has no sure way to detect a virus without signatures.

You could look for something like ThreatFire, but I don't think that it will help people who are unable to manually update virus definitions. It will look for any suspicious process and prompt user for action. This can interfere with normal functioning of some programs and can cause problems if user can't tell difference between regular program and virus.

Answer 3

Without Internet connection, the only solution is an anti-intrusion product (HIPS), which requires great understanding from the user (since blocking an essential Windows component is a bad idea).

So, if your user are inexperienced with computers, a standard anti-virus with automatic updates is the best solution. It will normally update itself whenever the user does finally connect to the Internet.

If not all computers are connected to the Internet, but all are connected to the internal network, you could set up a centralized server (connected to the Internet) that will push the definition updates to the entire network.

See for example : avast! Distributed Network Manager (ADNM).
Most major anti-virus products have similar solutions.

Answer 4

An antivirus needs Internet connection only for update virus database. So every antivirus can work without connection long time. But without update it can't detect new viruses. The problem is that costumer can use usb with data which is newer than virus database.
The question is what do you mean "basic protection". If you mean protect from old viruses you can use every antivirus software. If you mean good protection I don't believe that any antivirus can be sufficient for this task.

The solution of the problem can be not using antivirus on customer computers (it is useless) and check only external media on another computer.

Another solution can be using some security suite or personal firewall with sandbox feature.