About Opentopia
Opentopia Directory Encyclopedia Tools

Antivirus software

Encyclopedia : A : AN : ANT : Antivirus software

 

See also: Antiviral drug
Аntivirus software consists of computer programs that attempt to identify, thwart and eliminate computer viruses and other malicious software (malware).

Аntivirus software typically uses two different techniques to accomplish this:

Most commercial antivirus software uses both of these approaches, with an emphasis on the virus dictionary approach.

Historically, the term antivirus has also been used for benign computer viruses that spread and combated malicious viruses. This was common on the Amiga computer platform.

Contents

Approaches to virus detection

Virus dictionary approach

In the virus dictionary approach, when the antivirus software examines a file, it refers to a dictionary of known viruses that the authors of the antivirus software have identified. If a piece of code in the file matches any virus identified in the dictionary, then the antivirus software can take one of the following actions:
  1. attempt to repair the file by removing the virus itself from the file
  2. quarantine the file (such that the file remains inaccessible to other programs and its virus can no longer spread)
  3. delete the infected file
To achieve consistent success in the medium and long term, the virus dictionary approach requires periodic (generally online) downloads of updated virus dictionary entries. As civically minded and technically inclined users identify new viruses "in the wild", they can send their infected files to the authors of antivirus software, who then include information about the new viruses in their dictionaries.

Dictionary-based antivirus software typically examines files when the computer's operating system creates, opens, closes or e-mails them. In this way it can detect a known virus immediately upon receipt. Note too that a System Administrator can typically schedule the antivirus software to examine (scan) all files on the user's hard disk on a regular basis.

Although the dictionary approach can effectively contain virus outbreaks in the right circumstances, virus authors have tried to stay a step ahead of such software by writing "oligomorphic", "polymorphic" and more recently "metamorphic" viruses, which encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match the virus's signature in the dictionary.

Suspicious behavior approach

The suspicious behavior approach, by contrast, doesn't attempt to identify known viruses, but instead monitors the behavior of all programs. If one program tries to write data to an executable program, for example, the antivirus software can flag this suspicious behavior, alert a user and ask what to do.

Unlike the dictionary approach, the suspicious behavior approach therefore provides protection against brand-new viruses that do not yet exist in any virus dictionaries. However, it can also sound a large number of false positives, and users probably become desensitized to all the warnings. If the user clicks "Accept" on every such warning, then the antivirus software obviously gives no benefit to that user. This problem has worsened since 1997, since many more nonmalicious program designs came to modify other .exe files without regard to this false positive issue. Thus, most modern antivirus software uses this technique less and less.

Other ways to detect viruses

Some antivirus-software uses of other types of heuristic analysis. For example, it could try to emulate the beginning of the code of each new executable that the system invokes before transferring control to that executable. If the program seems to use self-modifying code or otherwise appears as a virus (if it immediately tries to find other executables, for example), one could assume that a virus has infected the executable. However, this method could result in a lot of false positives.

Yet another detection method involves using a sandbox. A sandbox emulates the operating system and runs the executable in this simulation. After the program has terminated, software analyzes the sandbox for any changes which might indicate a virus. Because of performance issues, this type of detection normally only takes place during on-demand scans.

Some virus scanners can also warn a user if a file is likely to contain a virus based on the file type.

Issues of concern

List of antivirus software and companies

For corporate market

Commercial and shareware

Freeware

This section includes usable free-of-charge versions of commercial software.

Note: BitDefender Free Edition doesn't provide any real-time protection.

Free software

Testing Organizations

These organizations provide testing of virus scanning and related programs.

History Of Anti-Virus Software and Development

The first anti-virus software was created by Dr. Peter Tippet in 1981. Dr. Tippet was an emergency room doctor who also ran a computer software company. He read an article about the first computer virus released onto the market (the Brain, Lehigh and Jerusalem2 were the first viruses to be developed, but it was Lehigh that Dr. Tippet read about) and he questioned whether they would have similar characteristics to viruses that attack humans. From an epidemiological viewpoint, he was able to determine how these viruses were affecting systems within the computer (the boot-sector was affected by the Brain virus, the .com files were affected by the Lehigh virus, and both .com and .exe files were affected by the Jerusalem virus). Dr. Tippet’s company Certus International Inc. then began to create anti-virus software programs. The company was sold in 1992 to Symantec Corp, and Dr. Tippet went to work for them, incorporating the software he had developed into Symantec’s product - Norton AntiVirus.

External links

 

From Wikipedia, the Free Encyclopedia. Original article here. Support Wikipedia by contributing or donating.
All text is available under the terms of the GNU Free Documentation License See Wikipedia Copyrights for details.

Search Titles
0123456789
ABCDEFGHIJ
KLMNOPQRST
UVWXYZ?

E-mail this article to:

Personal Message: