"Antivirus" redirects here. For antiviral medication, see antiviral drug. Antivirus software consists of computer programs that attempt to identify, thwart and eliminate computer viruses and other malicious software (malware). Antiviral drugs are a class of medication used specifically for treating viral infections. ...
A computer program is a collection of instructions that describe a task, or set of tasks, to be carried out by a computer. ...
A computer virus is a computer program that can copy itself and infect a computer without permission or knowledge of the user. ...
Malware is software designed to infiltrate or damage a computer system without the owners informed consent. ...
Antivirus software typically uses two different techniques to accomplish this:
- Examining (scanning) files to look for known viruses matching definitions in a virus dictionary
- Identifying suspicious behavior from any computer program which might indicate infection. Such analysis may include data captures, port monitoring and other methods.
Most commercial antivirus software uses both of these approaches, with an emphasis on the virus dictionary approach. This article is about computer files and file systems in general terms. ...
Approaches
Dictionary In the virus dictionary approach, when the antivirus software looks at a file, it refers to a dictionary of known viruses that the authors of the antivirus software have identified. If a piece of code in the file matches any virus identified in the dictionary, then the antivirus software can take one of the following actions: - attempt to repair the file by removing the virus itself from the file
- quarantine the file (such that the file remains inaccessible to other programs and its virus can no longer spread)
- delete the infected file
To achieve consistent success in the medium and long term, the virus dictionary approach requires periodic (generally online) downloads of updated virus dictionary entries. As civically minded and technically inclined users identify new viruses "in the wild", they can send their infected files to the authors of antivirus software, who then include information about the new viruses in their dictionaries.
Dictionary-based antivirus software typically examines files when the computer's operating system creates, opens, closes or e-mails them. In this way it can detect a known virus immediately upon receipt. Note too that a System Administrator can typically schedule the antivirus software to examine (scan) all files on the computer's hard disk on a regular basis. An operating system (OS) is the software that manages the sharing of the resources of a computer and provides programmers with an interface used to access those resources. ...
Typical hard drives of the mid-1990s. ...
Although the dictionary approach can effectively contain virus outbreaks in the right circumstances, virus authors have tried to stay a step ahead of such software by writing "oligomorphic", "polymorphic" and more recently "metamorphic" viruses, which encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match the virus's signature in the dictionary. In anti-virus terms, a virus that can change its encryptor but not the code base thats being encrypted. ...
In computer terminology, polymorphic code is code that mutates while keeping the original algorithm intact. ...
In computer virus terms, metamorphic code is code that can reprogram itself. ...
Suspicious behavior The suspicious behavior approach, by contrast, doesn't attempt to identify known viruses, but instead monitors the behavior of all programs. If one program tries to write data to an executable program, for example, the antivirus software can flag this suspicious behavior, alert a user and ask what to do.
Unlike the dictionary approach, the suspicious behavior approach therefore provides protection against brand-new viruses that do not yet exist in any virus dictionaries. However, it can also sound a large number of false positives, and users probably become desensitized to all the warnings. If the user clicks "Accept" on every such warning, then the antivirus software obviously gives no benefit to that user. This problem has worsened since 1997[citation needed], since many more nonmalicious program designs came to modify other .exe files without regard to this false positive issue. Thus, most modern antivirus software uses this technique less and less. A false positive, also called false alarm, exists when a test reports, incorrectly, that it has found a signal where none exists in reality. ...
Other approaches Some antivirus software use other types of heuristic analysis. For example, it could try to emulate the beginning of the code of each new executable that the system invokes before transferring control to that executable. If the program seems to use self-modifying code or otherwise appears as a virus (if it immediately tries to find other executables, for example), one could assume that a virus has infected the executable. However, this method could result in a lot of false positives. In computer science, besides the common use as rule of thumb (see heuristic), the term heuristic has two well-defined technical meanings. ...
In computer science, self-modifying code is code that alters its own instructions, whether or not it is on purpose, while it is executing. ...
Yet another detection method involves using a sandbox. A sandbox emulates the operating system and runs the executable in this simulation. After the program has terminated, software analyzes the sandbox for any changes which might indicate a virus. Because of performance issues, this type of detection normally only takes place during on-demand scans. Also this method may fail as viruses can be nondeterministic and result in different actions or no actions at all done when run - so it will be impossible to detect it from one run. [1] In computer security, a sandbox is a is a play item for little kids, suppliers and untrusted users. ...
Buskers perform in San Francisco A performance, in performing arts, generally comprises an event in which one group of people (the performer or performers) behave in a particular way for another group of people (the audience). ...
In the theory of computation, a nondeterministic algorithm is an algorithm with one or more choice points where multiple different continuations are possible, without any specification of which one will be taken. ...
Some virus scanners can also warn a user if a file is likely to contain a virus based on the file type. A file format is a particular way to encode information for storage in a computer file. ...
An emerging technique to deal with malware in general is whitelisting. Rather than looking for only known bad software, this technique prevents execution of all computer code except that which has been previously identified as trustworthy by the system administrator. By following this default deny approach, the limitations inherent in keeping virus signatures up to date are avoided. Additionally, computer applications that are unwanted by the system administrator are prevented from executing since they are not on the whitelist. Since modern enterprise organizations have large quantities of trusted applications, the limitations of adopting this technique rest with the system administrators' ability to properly inventory and maintain the whitelist of trusted applications. As such, viable implementations of this technique include tools for automating the inventory and whitelist maintenance processes. Malware is software designed to infiltrate or damage a computer system without the owners informed consent. ...
Look up whitelist in Wiktionary, the free dictionary. ...
For use of the term in mathematics, see signature (mathematics). ...
Look up whitelist in Wiktionary, the free dictionary. ...
Look up whitelist in Wiktionary, the free dictionary. ...
Issues of concern - The ongoing writing and spreading of viruses and of panic about them gives the vendors of commercial antivirus software a financial interest in the ongoing existence of viruses. Some theorize that antivirus companies have financial ties to virus writers, to generate their own market, though there is no evidence for this.[2]
- Some antivirus software can considerably reduce performance. Users may disable the antivirus protection to overcome the performance loss, thus increasing the risk of infection. For maximum protection the antivirus software needs to be enabled all the time — often at the cost of slower performance (see also software bloat).
- It is important to note that one should not have more than one antivirus software installed on a single computer at any given time. This can seriously cripple the computer and cause further damage.[3]
- It is sometimes necessary to temporarily disable virus protection when installing major updates such as Windows Service Packs or updating graphics card drivers.[citation needed] Having antivirus protection running at the same time as installing a major update may prevent the update installing properly or at all.
- When purchasing antivirus software, the agreement may include a clause that your subscription will be automatically renewed, and your credit card automatically billed at the renewal time without your approval. For example, McAfee requires one to unsubscribe at least 60 days before the expiration of the present subscription.[citation needed] In that case, the subscriber may contest the charges with the credit card issuer, but this recourse is likely to fail if in fact the subscriber had authorised such a "continuous payment authority".
- Some antivirus programmes are actually spyware masquerading as antivirus software. It is best to double-check that the antivirus software which is being downloaded is actually a real antivirus program.[4]
- Some commercial antivirus software programs contain adware. For example, the home/small business version of CA Anti-Virus 2008 displays an advert for CA products whenever the desktop is unlocked after a period of inactivity.
Software bloat, or bloatware, is a term used in both a neutral and disparaging sense, to describe the tendency of newer computer programs to be larger, or to use larger amounts of system resources (mass storage space, processing power or memory) than older versions of the same programs, without concomitant...
A graphics/video/display card/board/adapter is a computer component designed to convert the logical representation of visual information into a signal that can be used as input for a display medium. ...
McAfee, Inc. ...
A large number of toolbars, some added by spyware, overwhelm an Internet Explorer session. ...
This article is about advertising-supported software. ...
CA, Inc. ...
Antivirus, mobile devices and innovative solutions It would be no surprise when viruses that plague the desktop and laptop world quickly migrate to mobile devices. More and more vendors in this space are offering solutions to combat secure mobile handsets with antivirus solutions. Mobile devices present significant challenges for antivirus software, such as: - Processor constraints
- Memory constraints
- Definitions and new signature updates to these mobile handsets
SIM, flash based and USB based antivirus products Mobile handsets are now offered with a variety of interfaces and data connection capabilities. Consumers should carefully evaluate security products before deploying on small form factor devices.
Solutions that are hardware-based, perhaps USB devices or SIM-based antivirus solutions, might work better in meeting the needs of mobile handset consumers. Technical evaluation and review on how deploying an antivirus solution on cellular mobile handsets should be considered as scanning process might impact other legitimate applications on the handheld. Note: USB may also mean upper sideband in radio. ...
It has been suggested that Virtual sim be merged into this article or section. ...
SIM-based solutions with antivirus integrated on the small memory footprint might provide a basic solution to combat malware/viruses in protecting PIM and mobile user data. USB and Flash memory-based solutions give the user an advantage to swap and use these products with a range of hardware devices. A personal information manager (PIM) is a type of application software that functions as a personal organizer. ...
A USB flash drive. ...
History - See also: Timeline of notable computer viruses and worms
There are competing claims for the innovator of the first antivirus product. Perhaps the first publicly known neutralization of a wild PC virus was performed by European Bernt Fix (also Bernd) in early 1987. Fix neutralized an infection of the Vienna virus.[5] [6] First edition of Polish antivirus software mks_vir started in 1987. Program was only available in Polish language version. Autumn 1988 also saw antivirus software Dr. Solomon's Anti-Virus Toolkit released by Briton Alan Solomon. By December 1990 the market had matured to the point of nineteen separate antivirus products being on sale including Norton AntiVirus and ViruScan from McAfee. This is a list of noteworthy computer viruses and worms. ...
Norton AntiVirus (NAV) is a popular product of Symantec Corporation and is one of the most widely used antivirus programs. ...
This article does not cite any references or sources. ...
McAfee, Inc. ...
Peter Tippett made a number of contributions to the budding field of virus detection.[citation needed] He was an emergency room doctor who also ran a computer software company. He had read an article about the Lehigh virus and questioned whether they would have similar characteristics to biological viruses that attack organisms. From an epidemiological viewpoint, he was able to determine how these viruses were affecting systems within the computer (the boot-sector was affected by the Brain virus, the .com files were affected by the Lehigh virus, and both .com and .exe files were affected by the Jerusalem virus). Tippett’s company Certus International Corp. then began to create anti-virus software programs. The company was sold in 1992 to Symantec Corp, and Tippett went to work for them, incorporating the software he had developed into Symantec’s product, Norton AntiVirus.[citation needed] Symantec Corporation NASDAQ: SYMC, founded in 1982, is an international corporation which sells computer software, particularly in the realms of security and information management. ...
A very uncommon use of the term "antivirus" is to apply it to benign viruses that spread and combated malicious viruses. This was common on the Amiga computer platform.[citation needed] This article is about the family of home computers. ...
See also This is a list of notable antivirus software. ...
To aid the fight against viruses and other malware many security advisory organizations and developers of anti-virus software compile and publish lists of viruses. ...
This is a list of trojan horses. ...
This article is being considered for deletion in accordance with Wikipedias deletion policy. ...
The Linux operating system, along with Unix and other Unix-like computer operating systems, are generally regarded as well protected against computer viruses. ...
This is a list of noteworthy computer viruses and worms. ...
A computer virus hoax is a false email message warning the recipiant of a virus that is going around. ...
. ...
Notes - ^ Raynal, Frederic (2006-05-16). Malicious cryptography, part two.
- ^ Why there is no global antivirus software conspiracy, by Jonathan Yarden
- ^ Microsoft Support
- ^ List of rogue software
- ^ Kaspersky Lab Virus list
- ^ IBM anti-virus research timeline
External links - AV-ComparativesAV-TestVirusBulletin independent comparatives of several antivirus software
- Carnegie Mellon's CERT coordination center
- Computer Viruses at the Open Directory Project
- Virus Information including EICAR/Virus Bulletin
- Malware definitions
|
Feeds |
Contact