.edu Directory, Education Resource, EDU Links
Cyber Find: Anti-Virus Security
Authority EDU Links, Link Directory
   Cyber Home
   Cybotics
   Cybercafe
 
Authority EDU Links, Link Directory   Student Login
helpdesk@nassonu.edu
Antivirus software consists of computer programs that attempt to identify, thwart and eliminate computer viruses and other malicious software (malware).

Antivirus software typically uses two different techniques to accomplish this:
  • Examining (scanning) files to look for known viruses matching definitions in a virus dictionary
  • Identifying suspicious behavior from any computer program which might indicate infection. Such analysis may include data captures, port monitoring and other methods.
Most commercial antivirus software uses both of these approaches, with an emphasis on the virus dictionary approach.

In the virus dictionary approach, when the antivirus software looks at a file, it refers to a dictionary of known viruses that the authors of the antivirus software have identified. If a piece of code in the file matches any virus identified in the dictionary, then the antivirus software can take one of the following actions:
  1. attempt to repair the file by removing the virus itself from the file
  2. quarantine the file (such that the file remains inaccessible to other programs and its virus can no longer spread)
  3. delete the infected file
To achieve consistent success in the medium and long term, the virus dictionary approach requires periodic (generally online) downloads of updated virus dictionary entries. As civically minded and technically inclined users identify new viruses "in the wild", they can send their infected files to the authors of antivirus software, who then include information about the new viruses in their dictionaries.

Dictionary-based antivirus software typically examines files when the computer's operating system creates, opens, closes or e-mails them. In this way it can detect a known virus immediately upon receipt. Note too that a System Administrator can typically schedule the antivirus software to examine (scan) all files on the computer's hard disk on a regular basis.

Although the dictionary approach can effectively contain virus outbreaks in the right circumstances, virus authors have tried to stay a step ahead of such software by writing "oligomorphic", polymorphic" and more recently "metamorphic" viruses, which encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match the virus's signature in the dictionary.
Authority EDU Links, Link Directory