7) How does antivirus software work?
Description
This article is from the Computer viruses FAQ, by David Harley D.Harley@icrf.icnet.uk, George Wenzel gwenzel@telusplanet.net and Bruce Burrell bpb@umich.edu with numerous contributions by others.
7) How does antivirus software work?
* Scanner (conventional scanner, command-line scanner, on-demand
scanner) - a program that looks for known viruses by checking for
recognisable patterns ('scan strings', 'search strings',
'signatures' [a term best avoided for its ambiguity]).
* TSR scanner - a TSR (memory-resident program) that checks for
viruses while other programs are running. It may have some of
the characteristics of a monitor and/or behaviour blocker.
* VxD scanner - a scanner that works under Windows or perhaps under
Win 95, or both), which checks for viruses continuously while
you work.
* Heuristic scanners - scanners that inspect executable files for
code using operations that might denote an unknown virus.
* Monitor/Behaviour Blocker - a TSR that monitors programs while
they are running for behaviour which might denote a virus.
* Change Detectors/Checksummers/Integrity Checkers - programs that
keep a database of the characteristics of all executable files on
a system and check for changes which might signify an attack by
an unknown virus.
* Cryptographic Checksummers use an encryption algorithm to lessen
the risk of being fooled by a virus which targets that particular
checksummer.
Continue to:
My Books
