March 10, 2011
0

How antivirus works
Due to ever increasing threat from virus and other malicious programs, almost every computer today comes with a pre-installed antivirus software on it. In fact, an antivirus has become one of the most essential software package for every computer. Even though every one of us have an antivirus software installed on our computers, only a few really bother to understand how it actually works! Well if you are one among those few who would really bother to understand how an antivirus works, then this article is for you.

How Antivirus Works

An antivirus software typically uses a variety of strategies in detecting and removing viruses, worms and other malware programs. The following are the two most widely employed identification methods:

1. Signature-based dectection (Dictionary approach)

This is the most commonly employed method which involves searching for known patterns of virus within a given file. Every antivirus software will have a dictionary of sample malware codes called signatures in it’s database. Whenever a file is examined, the antivirus refers to the dictionary of sample codes present within it’s database and compares the same with the current file. If the piece of code within the file matches with the one in it’s dictionary then it is flagged and proper action is taken immediately so as to stop the virus from further replicating. The antivirus may choose to repair the file, quarantine or delete it permanently based on it’s potential risk. 
As new viruses and malwares are created and released every day, this method of detection cannot defend against new malwares unless their samples are collected and signatures are released by the antivirus software company. Some companies may also encourage the users to upload new viruses or variants, so that the virus can be analyzed and the signature can be added to the dictionary.
Signature based detection can be very effective, but requires frequent updates of the virus signature dictionary. Hence the users must update their antivirus software on a regular basis so as to defend against new threats that are released daily.

2. Heuristic-based detection (Suspicious behaviour approach)

Heuristic-based detection involves identifying suspicious behaviour from any given program which might indicate a potential risk. This approach is used by some of the sophisticated antivirus softwares to identify new malware and variants of known malware. Unlike the signature based approach, here the antivirus doesn’t attempt to identify known viruses, but instead monitors the behavior of all programs.
For example, malicious behaviours like a program trying to write data to an executable program is flagged and the user is alerted about this action. This method of detection gives an additional level of security from unidentified threats.
File emulation: This is another type of heuristic-based approach where a given program is executed in a virtual environment and the actions performed by it are logged. Based on the actions logged, the antivirus software can determine if the program is malicious or not and carry out necessary actions in order to clean the infection.
Most commercial antivirus softwares use a combination of both signature-based and heuristic-based approaches to combat malware.

Issues of concern

Zero-day threats: A zero-day (zero-hour ) threat or attack is where a malware tries to exploit computer application vulnerabilities that are yet unidentified by the antivirus software companies. These attacks are used to cause damage to the computer even before they are identified. Since patches are not yet released for these kind of new threats, they can easily manage to bypass the antivirus software and carry out malicious actions. However most of the threats are identified after a day or two of it’s release, but damage caused by them before identification is quite inevitable.
Daily Updates: Since new viruses and threats are released everyday, it is most essential to update the antivirus software so as to keep the virus definitions up-to-date. Most softwares will have an auto-update feature so that the virus definitions are updated whenever the computer is connected to the Internet.
Effectiveness: Even though an antivirus software can catch almost every malware, it is still not 100% foolproof against all kinds of threats. As explained earlier, a zero-day threat can easily bypass the protective shield of the antivirus software. Also virus authors have tried to stay a step ahead by writing “oligomorphic“, “polymorphic” and, more recently, “metamorphic” virus codes, which will encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match virus signatures in the dictionary.
Thus user education is as important as antivirus software; users must be trained to practice safe surfing habits such as downloading files only from trusted websites and not blindly executing a program that is unknown or obtained from an untrusted source. I hope this article will help you understand the working of an antivirus software.

0 comments:

Labels

INTERNET (141) HACKING TRICKS AND TIPS (129) SYSTEM TRICKS (104) OTHERS (93) HOW TO (88) GPRS TRICKS (84) AIRTEL TRICKS (68) FREE GPRS (61) 4SHARED TRICKS (60) MOBILE TRICKS (56) HOT TRICKS (52) 3G TRICKS (50) TRICKSNEW (50) WINDOWS TRICKS (45) MOBILE HACKS (44) SOFTWARE (41) HACKING TRICKS (40) CALL TRICKS (38) MINI PROJECTS (35) FUN TRICKS (33) IEEE PROJECTS (31) FACEBOOK TRICKS (30) AIRCEL TRICKS (29) Mobile Tips (28) DOWNLOAD (27) COMPUTER TRICKS (26) AIRTEL 3G HACK(100%) WORKING (25) ALL NETWORK TRICKS (25) DOCOMO TRICKS (25) FREE SMS HACKS (23) PASSWORD HAKING (23) LEARN-HACKING TRICKS (22) OTHER PROJECTS (22) FREE CALL TRICKS (20) NOTEPAD (20) gmail (19) HACKERS (18) RELIANCE TRICKS (18) ANTI-VIRUS (16) TATA DOCOMO TRICKS (16) VIRUS (16) AIRCEL 3G HACK(100%) WORKING (15) IDEA TRICKS (15) BROWSING TRICKS (14) SMS TRICKS (14) account (14) FREE SMS WEBSITES (13) VODAFONE TRICKS (13) FREE FAKE MAIL (12) MOBILE SOFTWARE (12) secret code (12) E-MAIL (11) FREE SMS CRICKET ALERT (11) OPERA HACK (11) ACKING TRICKS (10) CRACKING TRICKS (10) INDIA MATCH LIVE STREAMING ONLINE FREE (10) BSNL TRICKS (9) E-MAIL BOMBERS (9) FREE FAKE CALLS (9) SERIALS (9) SMS BOMBERS (9) premium account (9) ALL RESULTS (8) CHEAT CODES (8) GAMES DESIGN PROJECT (8) HOTFILE TRICKS (8) MINI PROJECTS-CSE (8) MINI PROJECTS-MCA (8) MOBILE APPLICATIONS (8) MOBILE TV (8) SEND SMS NOW (8) SOURCE CODES (8) portable application software (8) CHINA MOBILE (7) FREE MOBILE TV (7) PAYPAL ACCOUNT HACK (7) TUTORIAL (7) TV ONLINE (7) BALANCE TRICKS (6) CHATTING TIPS (6) Free SMS Websites (6) GOOGLE+ (6) INTERVIEW (6) PLACEMENT TIPS (6) UNINOR TRICKS (6) WATCH TV FREE (6) YOU TUBE TRICKS (6) avoid hacking (6) MEMORY CARD (5) PAPER PRESENTATION (5) RESULTS (5) VOIP CALLS (5) command prompt (5) BLUETOOTH TIPS (4) EXAM DATES (4) LEARN-HACKING (4) MOST NEEDED TRICKS (4) SOURCECODE (4) TORRENTS (4) WEB PROJECTS (4) Amazon (3) E-BOOKS (3) FIREFOX (3) FREE CRICKET MATCH 2011 LIVE STREAMING (3) JOBS (3) MODEM (3) RECHARGE TRICKS (3) VIDEOCON TRICKS (3) VIRGIN TRICKS (3) ANDROID (2) BOMBERS (2) C#.NET (2) CRICKET LIVE STREAMING (2) FREE MOVIE DOWNLOAD (2) HR ROUND (2) IPHONE TRICKS (2) IPL MATCH FIXING (2) Inspirational Success Stories - Zero to Hero (2) JAVA CODE (2) MTNL (2) MTS TRICKS (2) Mobile Number Portability (2) ONLINE-FREE SHOPPING (2) PROJECTS (2) TATA INDICOM (2) YAHOO (2) Cashback (1) DCE (1) DOWNLOAD MENU (1) DTH TRICKS (1) FREE SUBSCRIPTION ALERTS (1) GRAMMAR (1) IMAGE TRICKS (1) LINUX (1) MATLAB PROJECTS (1) MICROCONTROLLER PROJECTS (1) MOTOROLA (1) Most Common Interview Mistakes to Avoid (1) NANOPARTICLES IN THE DRUG DELIVERY (1) ONLINE EARNING (1) PEN DRIVE (1) PHISHERS (1) RAPIDSHARE TRICKS (1) Swiggy (1) TECHNICAL JOKES (1) TOLL FREE CONTACT NUMBER LIST (1) UBUNTU (1) WHATSAPP HACK (1) Wi-Fi (1) Zomato (1)