How Can Virus and Malware Protection Help | Antivirus Software

Antivirus developers like to say that without them you would simply be lost. Or at least your data would be gone. Some Windows users take the opposite point of view: Antivirus programs slow down system performance, annoy them with unnecessary warnings, and block completely harmless applications, while real malware can still sneak onto your computer.

While antivirus software can be incredibly annoying, it provides the insurance you need. Without antivirus software, any network interactions could have infected your computer with malware. In short: without anti-virus protection, the use of the Internet would become impossible.

The principle that currently existing antivirus programs use to protect users from malicious software (“malware” for short) is broadly the same. Anti-virus protection modules scan all files in real-time, that is, as soon as they get to the computer. The web protection module tries to prevent access to malicious sites. Finally, the antivirus scanner checks all local data for possible infections at the user's request.

All of these features really require processing power; in other words, they reduce system performance to some extent. However, there are techniques that are used to reduce this effect. One of them is a multi-layered approach to identifying malicious software.

A Brief Introduction To Anti-virus Protection

The easiest way to identify threats is to match the code with the signatures of known malware. Simply put, it boils down to checking if the file being analyzed matches the checksum from the blacklist.

The disadvantage of this approach is that attackers can bypass signature recognition through minor code changes. Heuristic analysis is a technique in which an antivirus program uses advanced detection criteria by matching a broader pattern, such as a specific piece of code instead of an entire file.

The advantage of heuristic analysis is that it easily recognizes different threat variants. But ... In the case of antivirus software, there is always a "but" ... Since the heuristic assumes some degree of assumption, it tends to mistake common harmless applications for malware.

Another approach is behavioral analysis. To do this, suspicious applications are first launched in a sandbox isolated from the operating system. However, this detection method is very resource-intensive, that is, when you run the sandbox on your computer, it can significantly affect its performance.

To work around these problems, antivirus vendors have developed online file reputation checking systems. If the local antivirus program is unsure of the file's purity, it can immediately contact its creator's servers to check if it is on the centralized whitelist. If the code is confirmed to be safe, the file will be allowed to run. If the code is unknown, it is sent as a sample to the developer's servers for centralized analysis. There, the sample is run in a virtual Windows environment, where its behavior is checked for unusual activity.

All of this usually happens without any user involvement. Therefore, antivirus programs can be thought of as kind little elves who work quietly and protect you. However, even elves are not immune to mistakes.

When Antivirus Tools Go Wrong

Despite whitelisting and online reputation checks, antivirus software sometimes fails. Harmless software stops working properly, access to harmless sites is blocked. These errors are called "false positives".

An example of a false positive is Comodo Internet Security Pro, which, under certain conditions, prevents users from launching SoftMaker Office 2018. When using default settings, Comodo's built-in firewall can block access to SoftMaker's activation servers. As a result, the software cannot verify the validity of the license and activation fails.

Software developers faced with such a problem have few other options but to contact the antivirus company, convince them of the legitimacy of their software, and request that their product be added to the company's whitelist. This may take some time. In the meantime, users have to find workarounds.

In the case of Comodo Internet Security Pro and SoftMaker Office 2018, the only way to activate the office suite currently is by disabling the antivirus module called "Content Filter". To do this, open the Comodo Internet Security settings and go to the Content Filter menu. In this section, disable the "Use content filter (recommended)" option and confirm your choice by clicking "OK".

In general, you should be very careful when disabling anti-virus protection elements. The best solution is to create application-specific exceptions - which is essentially creating a local whitelist. However, before adding such an exclusion, you should check and then re-check that the exclusion will not compromise the security of your computer. Several free online services can help with this verification.