Upping the Ante: the basics of antivirus software
Everyone who uses a computer has been at one time or another indebted to
antivirus software. It sits like a watchdog in your PC's backyard, waiting for
some pesky virus to jimmy the lock and try to mess with the treasures you've
stored in the inner sanctum of your hard drive. And, like a high-strung
Doberman, an antivirus is much more useful to you if you understand how it
operates, when to feed it, how often to walk it, et cetera.
Firstly, a few words on viruses. A virus is more than just a program that can
do bad things to your computer, such as damage your files or erase them
altogether or make it impossible for you to access them. A virus is a program
made up of binary code (ones and zeroes, just like the other programs that run
you PC); and the precise order of that code is called the virus' signature. Each
virus has a different signature.
Specifically, viral signatures are made up of self-replicating codes. No
clean computer program automatically replicates -- a fact that gives antivirus
programs something to look for. Antivirus programs learn and memorize all the
different replicating viral signatures that are already out there (40,000 to
date), and then compare the binary signatures of incoming files against those
already-known viral signatures to see if anything suspect is lurking on your
doorstep.
Another weapon possessed by the average antivirus is something called
heuristics. No, this is not a newfangled religion, nor is it a new-age euphemism
for hysteria; it's a technology that allows antiviral programs to detect
possible variants of the 40,000 known viruses. The drawback to this technology
is that it is not 100% accurate. Sometimes what resembles a viral variant is
actually a safe program. In this case, the user is often forced to delete a file
for no reason.
There is another type of virus, however, which is more insidious than your
run-of-the-mill piece of malicious code. It's called a polymorphic virus, and
its binary signature changes constantly. Antiviruses deal with these little
buggers by opening them not in the general space of the computer, but within the
antiviral application itself. The potential polymorphic virus is allowed to do
its stuff while the antivirus looks on. If foul programming is suspected, the
user is alerted to the virus and given the option of deleting it; if not, the
program is allowed to run its course outside the antivirus application.
The most common methods of transmitting viruses include downloads from the
internet, files saved from floppy disks, and e-mail attachments. It's a myth
that you can contract a virus just by reading an e-mail message. You must run a
program -- i.e., open an attachment, or floppy file, or anything that executes a
set of code -- in order to potentially kick-start a virus, so merely reading
e-mail is an entirely safe proposition. In addition, certain antiviruses are
installed on your e-mail server. These particular watchdogs don't even tell you
when they spot a virus; they just dispose of it without notifying you. In
today's world of service-oriented antivirus companies, this is becoming the
favoured method of dealing with bugs. The customer is kept both protected and
calm. After all, what you don't know can't hurt you as long as your antivirus
knows about it.