Welcome to the Computer Security Wiki! You can help us by expanding stubs, create new articles and improve current articles.
You can also help us by logging-in or creating an account!

Antivirus program

From Malware Wiki
Jump to: navigation, search

Nomalware.png This page is not malware, despite having an article on the Wiki.

Boxes of certain antivirus programs.

An antivirus program (also known as anti-virus or AV) is software used to detect and remove computer viruses, as well as many other types of harmful software, collectively referred to as malware. While the first antivirus programs was designed exclusively to combat computer viruses (hence "antivirus"), modern antivirus programs can protect computer systems against a wide range of malware, including worms, phishing attacks, rootkits,trojans, and some security suites may provide other protective programs such as tuneups, set up a Virtual Private Network (VPN), and more. They are mostly built for Microsoft Windows users as Windows has more viruses on its platform. However, no matter the operating system, if available, it is advised to run an antivirus. Sometimes when the user buys a new computer the user will have a pre-installed antivirus, and if the user buys one with Windows 8+, they will have a stronger version of Windows Defender (as Windows Defender on Windows 7 and earlier only removes spyware).

It is not recommended to run multiple real-time antivirus programs at once, as it may possibly slow down the user's computer, and may even quarrel with each other.

Identification methods

Signature-based detection

Signature based detection is the most common method that antivirus programs uses to identify malware. This method is somewhat limited by the fact that it can only identify known viruses, unlike other methods.

When an antivirus program scans a file for viruses, it checks the contents of a file against a dictionary of virus signatures. A virus signature is the viral code. So, saying the user found a virus signature in a file is the same as saying the user found the virus itself. If a virus signature is found in a file, the program can take action to remove the virus. Antivirus programs will usually perform one or more of the following actions; quarantining, repairing, or deleting. Quarantining a file will make it inaccessible, and is usually the first action antivirus programs will take if a malicious file is found. Encrypting the file is a good quarantining technique because it renders the file useless.

Sometimes a user wants to save the content of an infected file (because viruses can sometimes embed themselves in files, called injection.) To do this, the program attempts to repair the file. To do this, the software tries to remove the viral code from the file. Unfortunately, some viruses might damage the file upon injection, which means repairing will fail.

The third action antivirus programs can take against a virus is deleting it. If a file repair operation files, usually the best thing to do is to just delete the file. Deleting the file is necessary if the entire file is a virus.

Because new viruses are being created each day, the signature based detection approach requires frequent updates of the virus signature dictionary. To assist the antivirus software companies, the software may allow the user to upload new viruses or variants to the company. There, the virus can be analyzed and the signature added to the dictionary.

Signature-based antivirus programs typically examine files when the computer's operating system creates, opens, closes, or e-mails them. In this way it can detect a known virus immediately upon receipt. System administrators can schedule antivirus programs to scan all files on the computer's hard disk at a set time and date.

Although the signature based approach can effectively contain virus outbreaks in the right circumstances, virus authors have tried to stay a step ahead of such software by writing "oligomorphic", "polymorphic" and, more recently, "metamorphic" viruses, which encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match virus signatures in the dictionary.

An emerging technique to deal with malware in general is whitelisting. Rather than looking for only known bad software, this technique prevents execution of all computer code except that which has been previously identified as trustworthy by the system administrator. By following this "default deny" approach, the limitations inherent in keeping virus signatures up to date are avoided. Additionally, computer applications that are unwanted by the system administrator are prevented from executing since they are not on the whitelist. Since modern enterprise organizations have large quantities of trusted applications, the limitations of adopting this technique rests with the system administrators' ability to properly inventory and maintain the whitelist of trusted applications. Viable implementations of this technique include tools for automating the inventory and whitelist maintenance processes.

Suspicious behavior monitoring

The suspicious behavior approach, by contrast, does not attempt to identify known viruses, but instead monitors the behavior of all programs. If one program tries to write data to an executable program, for example, the antivirus program can flag this suspicious behavior, alert a user, and ask what to do.

Unlike the signature based approach, the suspicious behavior approach therefore provides protection against brand-new viruses that do not yet exist in any virus dictionaries. However, it can also sound a large number of false positives, and users may become desensitized to the warnings. If the user clicks "Accept" on every such warning, then the antivirus program gives no benefit to that user. In recent years, however, sophisticated behavior analysis has emerged, which analyzes processes and calls to the kernel in context before making a decision, which gives it a lower false positive rate than rules based behavior monitoring.


Some more sophisticated antivirus programs use heuristic analysis to identify new malware. Two methods are used; file analysis and file emulation.

As described above, file analysis is the process by which antivirus programs will analyze the instructions of a program. Based on the instructions, the software can determine whether or not the program is malicious. For example, if the file contains instructions to delete important system files, the file might be flagged as a virus. While this method is useful for identifying new viruses and variants, it can trigger many false alarms.

The second heuristic approach is file emulation. By the this approach, the target file is run in a virtual system environment, separate from the real system environment. The program then logs what actions the file takes in the virtual environment. If the actions are found to be damaging, the file will be marked a virus. But again, this method can trigger false positives.

See also


<references />

External links