A computer virus is a self-replicating program that installs itself on your computer without your consent, inserting itself into other programs, data files, or the boot sector of your hard drive. Once this happens, the affected areas are said to be ‘infected’.
Most viruses perform some sort of harmful activity: accessing confidential information, corrupting data, stealing hard disk space or processing power, logging your key-strokes, or spamming your contacts.
Anti-virus software is used to detect and remove computer viruses, using two basic approaches: signature scanning for known threats, and heuristics for unknown viruses.
Infected Files
Years ago most viruses lived in executable files (.exe, .com). Today, anti-virus software has to check a much wider variety of files, including Word documents with macros and even email bodies in some mail clients.
Identifying Viruses
Signature scanners search a computer’s boot record, programs, and macros for known patterns of code matching known viruses, using regularly updated ‘dictionaries’ of virus signatures. This is effective against known viruses but not new or modified ones.
Heuristic detectors look for code characteristics typical of viruses, using generic signatures to catch variants of known malware.
File emulation runs a file in an isolated ‘sandbox’ to observe its behaviour before deciding whether it’s malicious.
Memory-resident anti-virus software runs in the background, monitoring actions like downloads, running programs directly from the internet, or attempts to modify program code, halting suspicious activity for the user’s approval.
Drawbacks
Anti-virus software can slow a computer down slightly, can’t guarantee full protection, and can produce a false sense of security. Heuristic detection can also generate false positives — misidentifying safe files as viruses, which can render an operating system or application unusable if the software auto-quarantines or deletes them. Anti-virus software itself runs at a highly trusted kernel level, which can create its own attack surface.
Leave a Reply