Antivirus - DATA JUNK YARD

AntiVirus
Virus removal tools
What is Antivirus software?
is used to prevent, detect, and remove malware, including computer viruses, worms, and trojan horses. Such programs may also prevent and remove adware, spyware, and other forms of malware.

A variety of strategies are typically employed. Signature-based detection involves searching for known malicious patterns in executable code. However, it is possible for a user to be infected with new malware in which no signature exists yet. To counter such so called zero-day threats, heuristics can be used. One type of heuristic approach, generic signatures, can identify new viruses or variants of existing viruses for looking for known malicious code (or slight variations of such code) in files. Some antivirus software can also predict what a file will do if opened/run by emulating it in a sandbox and analyzing what it does to see if it performs any malicious actions. If it does, this could mean the file is malicious.

However, no matter how useful antivirus software is, it can sometimes have drawbacks. Antivirus software can degrade computer performance if it is not designed efficiently. Inexperienced users may have trouble understanding the prompts and decisions that antivirus software presents them with. An incorrect decision may lead to a security breach. If the antivirus software employs heuristic detection (of any kind), the success of it is going to depend on whether it achieves the right balance between false positives and false negatives. False positives can be as destructive as false negatives. In one case, a faulty virus signature issued by Symantec mistakenly removed essential operating system files, leaving thousands of PCs unable to boot.[1] Finally, antivirus software generally runs at the highly trusted kernel level of the operating system, creating a potential avenue of attack.[2]

In addition to the drawbacks mentioned above, the effectiveness of antivirus software has also been researched and debated. One study found that the detection success of major antivirus software dropped over a one-year period.[3]

A virus is a piece of malicious code or a software programme that has been written with the specific intent of causing damage to a computer or a network.

How does it work in practice?

A virus can be sent via an email or a document either from a friend, colleague or via a spurious email.

The best advice about viruses is that if you don’t know who the person is that has sent you an email; do not open it or indeed any attachments or links within the email.

An antivirus package will scan all incoming and outgoing emails to make sure that they don’t contain any viruses. If they discover a virus they will delete the appropriate files before it gets to you.

Why do I need it?

Quite simply, if you don’t have an antivirus package you will (unless you are extremely lucky) at some point be affected. This can cause major issues not only on your PC but is quite easy to pass across your organisation’s network and potentially impact everybody.

Is it something that I can install myself?

Yes, very much so. It is easy if you have just one PC but if your organisation has more than one and maybe a server, then it is important to install the software on those too.

Generally speaking, you can download an antivirus package either from a vendor’s website (and the appropriate number of licences according to how many users you have), or buy the disc from a vendor’s reseller.

Why do I need to update my antivirus package regularly?

New viruses are being created and developed all the time and naturally the antivirus vendors are developing counter measures to deal with them. If you don’t update your package regularly, you might miss an update and as a result your antivirus package may not pick up on a particular virus. As a result, it could cause issues on your PC and network.

You can easily automate the updating process to make sure that you’ll never miss an update.

What would happen if I don’t scan my PC every week?

You may not realise that one or a number of viruses have been introduced to your PC or network unless you scan for viruses regularly.

You can easily automate the scanning process so that it runs regularly, at a convenient time.

Make sure any antivirus programme you choose is listed on the ICSA Labs list. Being listed here shows that the software has passed tests to make sure it gives adequate protection.

You may also find that not all antivirus packages are able to deal with all malware or spyware and it may be necessary to have more than one package.

What’s the downside of installing an antivirus package?

The most common pitfall is that an antivirus package may slow down your PC. That said - the benefits far outweigh the potential downsides.

How do I measure whether the package I’ve purchased is making me money or saving me money?

Quite simply, you can’t! You hope that you will never find out because if your network ever suffers from a virus, it can cause havoc, potentially destroying years of hard work. And cost a lot of money to put right.