Antivirus protects your computer from viruses that can potentially infect files or sabotage your computers. Also, anything that you download is known as real-time protection or on-access scanning. You may think that files open immediately when you click on them, but in that split-second before opening your antivirus software will be working hard comparing the file that you want to open with already well-known malware.
Generally, antivirus software runs in the background of your computer, checking each file and folder you open.
An antivirus program does some unique things that most other executable on your system do not, like:-
- A well-developed anti-malware program is going to be one of the first programs that start when your system boots up.
- The anti-malware program is going to run with elevated privileges compared to some other non-system services that are running on your system because the antivirus programs have to run with such high privileges is to prevent malware or some other system anomaly from killing off that antivirus program.
If a malicious program were to load up before the antivirus there would most likely be some kind of function that prevents the antivirus from starting or that just automatically kills it when it tries to spawn and then it can’t do anything to stop the malware and the system level access is so that no other program can kill it off once it has started this is the reason why you may have found that you can’t close your antivirus program by ending the task in task manager usually when a malicious program first starts up it doesn’t have the same system-level access and in most cases a program cannot stop another program that has a higher privilege level than it.
How do antivirus programs detect viruses?
Today, they use a few different methods to detect and neutralize viruses on your computer.
One of the methods of detection developed was signature based detection the way that signature detection works is your antivirus program downloads a database of known virus signatures and the signatures here are typically either hashes of a malicious file or a piece of code to look for that is unique to the malware itself.
When your anti-malware program is scanning active programs in memory or files stored on your hard disk it’s comparing hashes of these files and looking at the contents of these files for those strings of malicious code and when it finds them it typically quarantines the file in a sandbox where it cannot replicate infect other files or cause harm to your system now obviously there’s new viruses coming out all the time and this is why you may have noticed that your antivirus program is constantly updating it’s constantly asking to download new virus definitions and this is what it’s doing it’s downloading those new signatures that have been uploaded by the provider of your antivirus.
What if malware is new or polymorphic?
If there’s no signature to actually compare it to and if the malware is polymorphic which is a common obfuscation technique signature-based detection won’t work against it in the future since the virus is going to have a different signature every time it runs because every time it runs it’s refactoring its own code to be completely different.
Signature-based detection
Signature-based detection isn’t as powerful and this is where heuristic base detection comes into play heuristic-based detection doesn’t look at signatures to uniquely identify a threat rather it uses a detection method similar to how humans and animals would detect threats by looking out for the behavior of the threat that’s in question and based on how it behaves taking a specific action one of the ways that antivirus does this is by running the suspected program in a virtualized environment and analyzing what it does in this environment before allowing it to run on your actual OS and this virtualized environment is sand-boxed away from other processes that are running on your system.
Heuristics checking
One of the methods is called heuristic checking, and this is where it looks for odd behaviour that could be a new and unknown virus and it does all of this before that file even opens up. Other than real-time protection, there’s also the option of a full system scan. Having real-time protection means that your antivirus software will immediately know if you’ve downloaded a virus.
Conclusion
Anti-malware is not a foolproof solution so how can you protect yourself from malware attacks well all malware has one thing in common it requires user intervention and at the end of the day malware cannot make its way onto your system unless you run a file open a suspicious document and enable content for a macro attack or go to a suspicious website and download an even more suspicious file.
A better solution to preventing a malicious attack is to remain vigilant know what you’re doing on the computer and don’t run any suspicious files anti-malware programs could still be good especially if you’re running an insecure os like windows.
So if you do come across a new form of malware, your antivirus software will be sure to know about and quarantine it and keep you safe, as antiviruses are highly complicated pieces of software.
