I moved from Symantec to Trend around that time because of their new version
causing so many BSODs. Everyone has problems, I guess. The bummer is that I
love the features of Trend, but they REALLY need to work on their catch
rates.
With the newer versions, having URL filtering and Web Reputation enabled
should keep them away from bad guys. However, for those too-new-to-be-listed
sites, I still recommend a WatchGuard firewall to my clients. AV's inability
to detect new threats is precisely why I like my WatchGuard that will not let
the executable through in the first place, whether from HTTP, HTTPS, FTP, or
SMTP traffic.
The way I look at it, letting it in via the front door, then tackling it and
inspecting it, hoping that you are better at recognition than the bad guy is
at hiding, is not as good as looking through the peephole, seeing it is
executable, flipping the trap door, and dropping it.
I have my WatchGuard set up to allow executables from Microsoft and Trend
Micro (after virus scan from the WG), maybe one or two others, but only to
certain IP addresses, mainly servers. I have bypass passwords that allow
managers to download truly needed executables from sites where they expect
the file but where I do not globally trust the site, and even then, they
still go through the virus scan of the WG (it uses AVG).
Of course, I also have Trend WFBS installed on all computers for threats
from other sources.
The best of both worlds! That is, IF I can convince my clients to buy the
firewall.
Gregg Hill