How should you protect yourself? How Antivirus Works | Complete Security

Antivirus is a program that looks for viruses, Trojans, worms, backdoors and other unwanted software on the user's computer. As a rule, antiviruses are developed for the Windows OS family, which, as it were, hints at the following features of this operating system: a) high prevalence, b) great vulnerability to attacks, c) great prospects of the antivirus market due to high commercialization (and Windows is paid for in most releases OS) and d), alas, low computer literacy of its users.

Antiviruses are free and paid. We will not talk in detail about the pros and cons of both categories here, I will only note that everything is not as straightforward as it might seem at first glance.

If you look at the antivirus from the outside, you can easily mistake it for a virus, but only with a plus sign. Antivirus working methods - monitoring network traffic, listening on ports, monitoring services, modifying and deleting files, collecting statistics and sending data to the software developer, a hefty consumption of computing power ... Is that not enough equipment failure! Of course, all this is aimed at the benefit of the user and in the name of preserving his data, but the overall picture is at least curious. By the way, it is precisely because of this feature that it is highly discouraged to install two antiviruses on one machine at once. Not only is it rare for anyone to succeed without dancing with a tambourine, but the consequences of their joint "work" can be the most bizarre, even lethal for the OS.

The myth that many viruses are created by the antivirus companies themselves are firmly entrenched in the mass consciousness, and a good article here will dot the I's in this matter.

Different antiviruses deal with malware in different ways. All antiviruses can detect viruses, but, unfortunately, not all can be effectively cured. The antivirus can include several modules, depending on the release and what the antivirus developer is capable of. The modules can be the following: a module for searching for unwanted software, a module for analyzing suspicious program behaviour (heuristic module), a quarantine module for isolating suspicious files, an update module for keeping up-to-date with new threats, a module for "healing" infected files, a firewall, or a firewall, and some others.

Antivirus is not a panacea! This is one of the many "fighters" thrown into the battle with security threats in an endless war for information and not the strongest. No antivirus provides 100% protection due to the peculiarities of its functioning.

Unfortunately, most of the anti-virus work is aimed at eliminating the consequences of "unhygienic" risky, and sometimes, alas, simply illiterate user work on the Internet, with external storage media and unknown applications.

Basic Methods of Fighting Viruses

Signature Detection Method

You have probably met with messages from an antivirus, for example, Protegent360 Anti-Virus complete security, that the anti-virus databases are out of date and need to be updated. What bases are we talking about?

Antivirus laboratory - an antivirus developer - detects a virus, analyzes it, and reveals a so-called signature. A virus signature (attack signature) is a special digital sign of a malicious program, by which it can be “recognized” and unambiguously identified. These signatures are entered into the database, whose update is regularly downloaded by the user manually or on a schedule. A message from the antivirus that the virus database is outdated signals a weakening of protection and an increase in the likelihood of picking up some "fresh".

The Advantages of this Method:

1. Proven reliability. The method has been used for a long time and with success, we can say that this is the main method for detecting a virus.

2. High performance.

Disadvantages:

1. The problem of an avalanche-like increase in signatures. The growth in the number of new viruses and the ability to mutate in the "old" are also to blame. As a result, the signature databases grow to indecent sizes, so the second advantage of the method is lost. The situation is resolved by special optimizations when one signature describes many viruses at once, but this raises the problem of false positives, which reduces the first advantage.

2. The problem of detecting new viruses. It is believed that the users themselves are contributing too little to the increase in the virus database. That is, the detection of new viruses is as if the problem of antivirus developers, which on the one hand seems fair, on the other is a violation of the principle "security is everyone's business." Many antiviruses have a built-in “send for check” function, which should be used unrestrictedly. The main methods for solving the problem are the mutual exchange of information with other anti-virus firms, heuristic (that is, intelligent, using a special algorithm) search for viruses on the Internet, a quick response during epidemics and the conscientiousness of system engineers analyzing suspicious activity on the network.

Heuristic Detection Methods

Many antivirus programs contain a module for the so-called heuristic search for malware. The essence of the method lies in the analysis of the behaviour of all launched programs. If during the operation of the system, "suspicious" the behaviour of the application is suddenly detected, that is, the program suddenly starts doing what it has not done before, an alarm is triggered and the heuristic module informs the user of a potential threat.

Advantages of the Method:

1. This is a very promising direction, in the future the capabilities of the heuristic the module will increase and the computer and information will be better protected from unexpected and new threats.

2.   The the heuristic module can respond to threats, information about which is not in the signature database.

Disadvantages of the Method:

1. False triggering for safe events. As a result, the user can turn off the heuristic module in annoyance, reducing the protection.

2. Due to the peculiarities of the heuristic module, there is a problem of excessive consumption of computing power. Simply put, the antivirus eats up all the memory and the processor, as a result, not that you can't play games, you can't really work in Word. The result is the same - disabling the module and reducing protection.

Firewall or Firewall

The firewall is designed to protect against network threats - from the local network and the Internet.

This module is not always included in the standard set of antivirus often a firewall is developed, supplied and sold as a separate program.

Many programs to connect to remote computers or servers can use unsafe methods, leaving holes and vulnerabilities for outside penetration.

The essence of a firewall is to control both inbound and outbound traffic by limiting the ability to establish connections to certain remote resources. The most obvious method of protection is white and blacklists of network resources.

The "black" list of network resources is a list, for example, of sites that cannot be entered and the "white" list is a list of resources where only one can go. As you can see, the whitelisting method is much more secure, but it also severely limits the capabilities of the user and programs.

Advantages of a firewall:

1.The firewall settings allow you to ensure that only trusted resources can be networked, cutting out all potentially dangerous and unverified resources.

2. It can be installed on a network gateway of a local area network, that is, on a server that "distributes" Internet access to computers, for example, schools, without wasting the computing resources of user machines.

Disadvantages of a firewall:

1.The disadvantage of a firewall logically follows from its advantage: to properly configure a firewall requires a good knowledge of network protocols and the way network applications work. A firewall with default settings does little to protect against.