Author Topic: How Does Anti virus detects viruses?  (Read 662 times)

0 Members and 1 Guest are viewing this topic.

Offline ebenzunlimited

  • Lead Admin
  • *****
How Does Anti virus detects viruses?
« on: May 24, 2012, 10:19:39 PM »
I hope you know what is computer Anti Virus. But you may not know how the anti virus works.  Here i am sharing how the antivirus software works.

What you know about Anti Virus software?
Antivirus software gives protection against the viruses and Malware. Antivirus can detect the malicious software ,then delete or put it in quarantine.



The process behind the Anti Virus
The Antivirus follows two methods to detect the malicious software. They are

    Virus Dictionary Based Detection
    Suspicious Activity Detection

Virus Dictionary Based Detection
In this method, Antivirus manage a dictionary file which has the identified virus signatures. Whenever an executable is running, antivirus will check the executable file source code with the dictionary.  If the source code match with any virus signature, then antivirus will immediately inform you that the virus is found.
Antivirus will check the executable file whenever file is opened or created or emailed or downloading.

Example:
Let us assume the malicious code is "11010011" and this code is in dictionary file.  If any executable file runs with the above malicious code, the antivirus immediately block and alerts the user.

Day to day the h*ckers can create new viruses, the source code of virus will vary.  The antivirus can not detect the virus with old Signature of viruses.  You have to update the virus signature so that it can detect new viruses.


Drawback of this Method

h*ckers found a h*cking trick to bypass this security method, The Crypter.  Yes,  h*ckers can encrypt the source code into different source code such that it will look like safest source code.  So if the antivirus checks for the source code, it won't find the malicious code (because it is another form). (I will give detailed explanation about the crypter in my next post.).  The drawback can be solved by including the crypted malicious code to dictionary file.

 Suspicious Activity Detection
The suspicious activity detection method is more effective than the Dictionary based approach.  It can detect even a new virus. Antivirus observes the behavior of the executable file. If the executable file does any illegal process or create any executable file, the antivirus will block the executable file and alert the user .


Drawback
It is annoying process.  The accuracy is less so it may detect any safe executable file as virus.
Insane I Lived♥ Sane I Died♥<img src='http://i253.photobucket.com/albums/hh74/reallytired2/family%20pictures/buckeye%20stuff/clap.gif' />

 

* Post Updates

Re: Export MBOX Files to Outlook PST Emails by Somit Vishwakarma
[November 28, 2020, 01:06:01 PM]


WPX is giving out 6 months of free WordPress hosting this week by obasimiracle
[November 25, 2020, 01:56:47 AM]


Re: Outlook PST Merge by ruth less
[November 11, 2020, 07:22:38 AM]

Inside: 3P Techies Blog

* Newest Techies

Get Updates


Sign up to get latest updates delivered to your inbox. No Spam, We Promise!

Get Hosting!

a Faster web hosting service

Copyright 3rd Planet Techies. All rights Reserved.

Top || Mobile || Privacy