ANTIVIRUS

Amardeep singh patel Shambhu sharan mishra Gaurav pandey

I.T. department I.T. department I.T. department

Abstract- Antivirus software is used adware, spyware,and other forms of

to prevent, detect and remove malware, malware. A variety of strategies are
including Computer viruses, worms ,and typically employed.signature based
trojon horses. Such programs may also detection involves searching for known
prevent and remove adware,spyware and malicious patterns in executable code
other forms of malware. Fred cohen, one However, it is possible for a user to be
of the first academic Papers on computer infected with new malware for which no
viruses in 1984,started to develop signature exists yet. To counter such so-
strategies for antivirus software in 1988 called zero-day threats, heuristics can be
that were picked up and continued by used. One type of heuristic approach,
later antivirus software developers. By generic signatures, can identify new
using different methods it can detect the viruses or variants of existing viruses by
different types of malware.some of them looking for known malicious code (or
are signature based detection,heuristics, slight variations of such code) in files.
rootkit detection. A virus might corrupt Some antivirus software can also predict
or delete data on your computer, use what a file will do if opened/run by
your e-mail program to spread itself to emulating it in a sandbox and analyzing
other computers or even erase anything what it does to see if it performs any
on your hard disk. Computer viruses are malicious actions. If it does, this could
often spread by Attachments in e-mail mean the file is malicious.
messages or instant messaging messages However, no matter how useful antivirus
That is why it is essential that you never software is, it can sometimes have
open e-mail attachments unless youknow drawbacks. Antivirus software can
who it’s from and you are expecting it. degrade computer performance.
There are different types of viruses for Inexperienced users may have trouble
which antiviruses are made to detect understanding the prompts and decisions
these viruses . worms ,trojon horses and that antivirus software presents them
logic bombs are different viruses and with. An incorrect decision may lead to a
Kaspersky,Trend micro,McAfee,AVG, security breach. If the antivirus software
avast!,G Data,Avira etc.are some employs heuristic detection (of any
antivirusessoftwares. kind), success depends on achieving the
right balance between false positives and
Introduction- antivirus software is false negatives. False positives can be as
used to prevent ,detect,and remove destructive as false negatives. Finally,
malware,including computer viruses, antivirus software generally runs at the
worms and Trojan horses. Such highly trusted kernel level of the
programs may also prevent and remove operating system, creating a potential
avenue of attack.
In addition to the drawbacks mentioned spread by infected floppy disks.
above, the effectiveness of antivirus Antivirus software came into use, but
software has also been researched and was updated relatively infrequently.
debated. One study found that the During this time, virus checkers
detection success of major antivirus essentially had to check executable files
software dropped over a one-year period. and the boot sectors of floppy and hard
disks. However, as internet usage
History- Most of the computer viruses became common, initially through the
that were written in the early and mid use of modems, viruses spread
'80s were limited to self-reproduction throughout the Internet.
and had no specific damage routine built
into the code (research viruses). That Identification methods- There are
changed when more and more several methods which antivirus
programmers became acquainted with software can use to identify malware.
virus programming and released viruses
that manipulated or even destroyed data Signature based detection is the most
on infected computers. It then became common method. To identify viruses and
necessary to think about antivirus other malware, antivirus software
software to fight these malicious compares the contents of a file to a
viruses.There are competing claims for dictionary of virus signatures. Because
the innovator of the first antivirus viruses can embed themselves in
product. Possibly the first publicly existing files, the entire file is searched,
documented removal of a computer virus not just as a whole, but also in pieces.
in the wild was performed by Bernd Fix
in 1987. Heuristic-based detection like
malicious activity detection, can be used
Fred Cohen, who published one of the to identify unknown viruses.
first academic papers on computer
viruses in 1984, started to develop File emulation is another heuristic
strategies for antivirus software in 1988 approach. File emulation involves
that were picked up and continued by executing a program in a virtual
later antivirus software developers. environment and logging what actions
the program performs. Depending on the
Also in 1988 a mailing list named actions logged, the antivirus software
VIRUS-L was initiated on the can determine if the program is
BITNET/EARN network where new malicious or not and then carry out the
viruses and the possibilities of detecting appropriate disinfection actions.
and eliminating viruses were discussed.
Some members of this mailing list like Rootkit detection Anti-virus software
John McAfee or Eugene Kaspersky later now scans for rootkits; a rootkit
founded software companies that is a type of malware that is
developed and sold commercial antivirus designed to gain administrative-
software. level control over a computer
system without being detected.
Before Internet connectivity was Rootkits can change how the
widespread, viruses were typically operating system functions and in
 some cases, rootkits can tamper Bounty hunters is a virus which can
with the anti-virus program and modify signatures stored by an antivirus
render it ineffective. Rootkits are program in order to render them
also very difficult to remove, in inoperable.
some cases requiring a complete
re-installation of the operating Polymorphic viruses
system. Since antivirus programs mainly detect
viruses using their signature (the series
Viruses - Introduction to viruses of bits which identifies it), certain virus
A virus is a small computer program creators have thought to give them the
found within the body of another ability to automatically change their
program which, when run, loads itself appearance, like a chameleon, by giving
into the memory and carries out the the virus a signature encrypt-decrypt
instructions programmed by its function, so that only the virus can
author.Memory-resident viruses (also recognise its own signature. This kind of
called TSR for Terminate and Stay virus is called a "polymorphic virus"
Resident) load in the computer's RAM in (from the Greek for "which can take
order to infect executable files opened multiple forms").
by the user. Non-resident viruses, once
run, infect programs found on the hard Boot sector viruses
drive. A "boot sector virus" (or boot virus) is
The effects of a virus may range from a virus when can infect the boot sector of
simply displaying a ping-pong ball a hard drive (MBR, the master boot
ricocheting across the screen to wiping record). This sector is an area on the
out data, which is the most destructive hard drive stores the operating system
kind of virus there is. As there is a broad processes which are run when the
range of viruses with widely varied computer starts up.
effects, viruses are not classified based
on what kind of damage they do, but on Issues of concern-
how they spread and infect computers.
Unexpected renewal costs
Types of viruses- Some commercial antivirus software
end-user license agreements include a
Worms are viruses which can spread clause that the subscription will be
over a network . automatically renewed, and the
purchaser's credit card automatically
Trojan horses(trojans) are viruses billed, at the renewal time without
which create a security hole in the explicit approval. For example, McAfee
computer (generally for their designer to requires users to unsubscribe at least 60
gain entry to the infect system and take days before the expiration of the present
control of it) subscription while BitDefender sends
notifications to unsubscribe 30 days
Logic bombs are viruses which can before the renewal.Norton Antivirus also
trigger on a specific event (like the renews subscriptions automatically by
system's date, or remote activation). default.
 System and interoperability related
Rogue security applications issues
Some antivirus programs are actually Running multiple antivirus programs
malware masquerading as antivirus concurrently can degrade performance
software, such as WinFixer and MS and create conflicts.
Antivirus. A recent surge in such It is sometimes necessary to temporarily
software has deceived more than a disable virus protection when installing
million Microsoft Windows internet major updates such as Windows Service
users and prompted the FTC to initiate Packs or updating graphics card
court proceedings. drivers.Active antivirus protection may
partially or completely prevent the
Problems caused by false positives installation of a major update.
A false positive is identifying a file as a
virus when it is not a virus. If an Support issues also exist around
antivirus program is configured to antivirus application interoperability
immediately delete or quarantine with common solutions like SSL VPN
infected files (or does this by default), remote access and network access
false positives in essential files can control products.Often, these technology
render the operating system or some solutions have policy assessment
applications unusable. In May 2007, a applications which require that 1. an
faulty virus signature issued by antivirus is installed 2. that the product is
Symantec mistakenly removed essential running and 3. that the application's
operating system files, leaving thousands signatures are up to date. If the antivirus
of PCs unable to boot. Also in May 2007 application is not recognized by the
the executable file required by Pegasus policy assessment, whether because the
Mail was falsely detected by Norton antivirus application has been updated or
AntiVirus as being a Trojan and it was because it is not part of the policy
automatically removed, preventing assessment library, the user will be
Pegasus Mail from running. Norton anti- unable to connect. Interoperability
virus has falsely identified three releases testing and certification for antivirus
of Pegasus Mail as malware; Norton applications is offered by the OESIS OK
anti-virus can delete the Pegasus Mail Program.
installer file when this happens.
In April 2010 McAfee VirusScan Effectiveness
detected svchost.exe, a normal Windows Studies in December 2007 have shown
binary, as a virus on machines running that the effectiveness of antivirus
XP SP3 and removed it, causing a reboot software has decreased in recent years,
loop and loss of all network access. particularly against unknown or zero day
attacks. The German computer magazine
Spotify has been flagged as a false c't found that detection rates for these
positive by Symantec and McAfee threats had dropped from 40-50% in
products. Even when the false positive is 2006 to 20-30% in 2007. At that time,
rectified by an update, users may have to the only exception was the NOD32
re-install Spotify. antivirus, which managed a detection
rate of 68 percent.
The problem is magnified by the (Anti-Malware Testing Standards
changing intent of virus authors. Some Organization).
years ago it was obvious when a virus
infection was present. The viruses of the
day, written by amateurs, exhibited
destructive behavior or pop-ups. Modern
viruses are often written by
professionals, financed by criminal
organizations.

Traditional antivirus software solutions

run virus scanners on schedule, on
demand and some run scans in real time.
If a virus or malware is located the
suspect file is usually placed into a
quarantine to terminate its chances of
disrupting the system. Traditional
antivirus solutions scan and compare
against a publicised and regularly
updated dictionary of malware otherwise
known as a blacklist. Some antivirus
solutions have additional options that
employ an heuristic engine which further
examines the file to see if it is behaving
in a similar manner to previous examples
of malware. A new technology utilized
by a few antivirus solutions is
whitelisting, this technology first checks
if the file is trusted and only questioning
those that are not.
References-
Independent testing on all the major
virus scanners consistently shows that [1] http://www.google.co.in/
none provide 100% virus detection. The http://www.wikipedia.com/
best ones provided as high as 99.6% http://www.avast.com/
detection, while the lowest provide only http://www.microsoft.com/
81.8% in tests conducted in February
2010. All virus scanners produce false
positive results as well, identifying
benign files as malware.

Although methodologies may differ,

some notable independent quality testing
agencies include AV-Comparatives,
ICSA Labs, West Coast Labs, VB100
and other members of the AMTSO