Anti-virus software consists of computer programs that attempt to identify, thwart and eliminate computer viruses and other malicious software (malware).

Anti-virus software typically uses two different techniques to accomplish this:

• Examining (scanning) files to look for known viruses matching definitions in a virus dictionary
• Identifying suspicious behavior from any computer program which might indicate infection. Such analysis may include data captures, port monitoring and other methods.

Most commercial anti-virus software uses both of these approaches, with an emphasis on the virus dictionary approach.

Historically, the term anti-virus has also been used for benign computer viruses that spread and combated malicious viruses. This was common on the Amiga computer platform.

Approaches to virus detection

Virus dictionary approach

In the virus dictionary approach, when the anti-virus software examines a file, it refers to a dictionary of known viruses that the authors of the anti-virus software have identified. If a piece of code in the file matches any virus identified in the dictionary, then the anti-virus software can take one of the following actions (in order by favorability):

1. attempt to repair the file by removing the virus itself from the file
2. quarantine the file (such that the file remains inaccessible to other programs and its virus can no longer spread)
3. delete the infected file

To achieve consistent success in the medium and long term, the virus dictionary approach requires periodic (generally online) downloads of updated virus dictionary entries. As civically minded and technically inclined users identify new viruses "in the wild", they can send their infected files to the authors of anti-virus software, who then include information about the new viruses in their dictionaries.

Dictionary-based anti-virus software typically examines files when the computer's operating system creates, opens, closes or e-mails them. In this way it can detect a known virus immediately upon receipt. Note too that a System Administrator can typically schedule the anti-virus software to examine (scan) all files on the user's hard disk on a regular basis.

Although the dictionary approach can effectively contain virus outbreaks in the right circumstances, virus authors have tried to stay a step ahead of such software by writing "oligomorphic", "polymorphic" and more recently "metamorphic" viruses, which encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match the virus's signature in the dictionary.

Suspicious behavior approach

The suspicious behavior approach, by contrast, doesn't attempt to identify known viruses, but instead monitors the behavior of all programs. If one program tries to write data to an executable program, for example, the anti-virus software can flag this suspicious behavior, alert a user and ask what to do.

Unlike the dictionary approach, the suspicious behavior approach therefore provides protection against brand-new viruses that do not yet exist in any virus dictionaries. However, it also sounds a large number of false positives, and users probably become desensitized to all the warnings. If the user clicks "Accept" on every such warning, then the anti-virus software obviously gives no benefit to that user. This problem has worsened since 1997, since many more nonmalicious program designs came to modify other .exe files without regard to this false positive issue. Thus, most modern anti-virus software uses this technique less and less.

Other ways to detect viruses

Some antivirus-software will try to emulate the beginning of the code of each new executable that the system invokes before transferring control to that executable. If the program seems to use self-modifying code or otherwise appears as a virus (if it immediately tries to find other executables, for example), one could assume that a virus has infected the executable. However, this method too results in a lot of false positives.

Yet another detection method involves using a sandbox. A sandbox emulates the operating system and runs the executable in this simulation. After the program has terminated, software analyzes the sandbox for any changes which might indicate a virus. Because of performance issues, this type of detection normally only takes place during on-demand scans.

Issues of concern

• The spread of e-mail viruses (arguably the most destructive and widespread computer viruses) could be inhibited far more inexpensively and effectively, and without the need to install anti-virus software, if bugs in the e-mail clients, which relate to the execution of downloaded code and to the ability of executables to spread and wreak havoc, were fixed. The relative inability of executables to spread and wreak havoc on Unix based platforms (because Unix is designed to be primarily used without administrative privilege, and is virtually bullet-proof secure against users without administrative privilege) is one of the reasons viruses are virtually non-existent on operating systems like Apple's Mac OS X.
• User education can effectively supplement anti-virus software; simply training users in safe computing practices (such as not downloading and executing unknown programs from the Internet) would slow the spread of viruses and obviate the need of much anti-virus software.
• Computer users should not always run with administrator access to their own machine. If they would simply run in user mode then some types of viruses could not spread (or at least the damage caused by viruses could be reduced). This is one of several reasons that viruses are virtually non-existent in Unix-like systems.
• The dictionary approach to detecting viruses does not always suffice -- due to the continual creation of new viruses -- yet the suspicious behavior approach does not work well due to the false positive problem; hence, the current understanding of anti-virus software will never conquer computer viruses.
• Various methods exist of encrypting and packing malicious software which will make even well-known viruses undetectable to anti-virus software. Detecting these "camouflaged" viruses requires a powerful unpacking engine, which can decrypt the files before examining them. Unfortunately, many popular anti-virus programs do not have this and thus are often unable to detect encrypted viruses.
• The ongoing writing and spreading of viruses and of panic about them gives the vendors of commercial anti-virus software a financial interest in the ongoing existence of viruses.
• Some anti-virus software can considerably reduce performance. Users may disable the anti-virus protection to overcome the performance loss, thus increasing the risk of infection. For maximum protection the anti-virus software needs to be enabled all the time - often at the cost of slower performance (see also Software bloat). Some anti-virus software has less impact on performance.
• It is sometimes necessary to temporarily disable virus protection when installing major updates such as Windows Service Packs or updating Graphics card drivers for example. Having anti-virus protection running at the same time as installing a major update may prevent the update installing properly or at all.

Antivirus software and companies

For corporate market

• Vexira from Central Command [1] -- Antivirus, antispam, and antispyware solutions.
• GFi WebMonitor and GFi MailSecurity - WWW and email security solutions, by GFI Software
• BitDefender from Romania - email security solutions
• Security solutions by *Sybari Software. Sybari Software had been purchased by Microsoft in early 2005.
• Sophos from UK provides antivirus solutions, with evaluation version
• Trend Micro Security Solutions for Enterprises, SMB and Consumers. Leader in gateway protection.
• Dr.Web by Doctor Web, Ltd. from Russia - email/www security solutions, corporate networks protection
• Uniwares Leon Enterprise Anti-Spam Server (with integrated AV) - Uniwares Ltda.

Commercial and shareware

• AhnLab V3Pro by AhnLab from Korea
• Kaspersky Antivirus by Kaspersky from Russia
• McAfee Antivirus by McAfee from USA
• Norton AntiVirus by Symantec
• Bullguard Antivirus Software, Firewall and Backup, by BullGuard from Denmark/UK
• F-Secure from Finland
• VirusBuster from Hungary
• NOD32 by Eset from Slovak Republic, shareware
• Norman from Norway
• ROSE SWE, shareware and some freeware
• Panda Software from Spain
• Rising AntiVirus from China
• Virex by McAfee
• VirusBarrier by Intego

Freeware

This section includes usable free-of-charge versions of commercial software.

• Avast! by Alwil from Czech Republic
• Antivir Personal Edition Classic by H+BEDV from Germany
• AVG Anti-Virus by Grisoft

GPL software

• ClamAV by Tomasz Kojm
  • ClamWin by alch
  • ClamTk - http://clamtk.sourceforge.net/
  • ClamXav

Unclassified

• Aladdin Knowledge Systems
• Cat Computer Services, makers of Quick Heal AntiVirus from India
• Computer Associates USA
• Frisk Software from Iceland
• Hauri
• MicroWorld Technologies from India
• MKS from Poland
• RAV Antivirus from Romania (bought in 2003 from GECAD)
• Stiller Research
• Zone Labs for ZoneAlarm AntiVirus

Testing Organizations

These organizations provide testing of virus scanning and related programs.

• Virus Bulletin - http://www.virusbtn.com/
• ICSA Labs - http://www.icsalabs.com/
• West Coast Labs - http://www.westcoastlabs.org/
• GFI Software - http://www.emailsecuritytest.com/

External links

• AntiVirus -Virus Removal Software
• Carnegie Mellon's CERT coordination center
• eicar - European Institute for Computer Anti-Virus Research
• firewallguide.com's Anti-Virus Guide
• Antisource.com - Antivirus Reviews
• HouseCall - Online Virus Scan (x-platform compatible)
• Planet Security - PC and Network Security
• About.com - Top 7 Windows Antivirusbs:Anti-virus program