Computer Virus and Antivirus Technologies

Computer Virus and Antivirus Technologies

Acomputer virus is a self-replicating program that spreads by inserting copies of itself into other executable code or documents. The term virus is often extended to refer to computer worms and other sorts of malware. The most common are:

• Viruses - A virus is a small piece of software that piggybacks on other programs or files. Each time the program runs or file opens, the virus runs, too. It can reproduce itself by attaching to other programs or files or wreak havoc.
• E-mail viruses - An e-mail virus moves around in e-mail messages, and usually replicates itself by automatically mailing itself to dozens of people in the victim's e-mail address book. Pharmers send e-mails contains a virus that installs small software programs on users' computers. When a user tries to go to the bank's real Web site, the program redirects the browser to the pharmer's fake site. It then asks a user to update information such as logons, PIN codes or other sensitive information. 
• Worms - A worm is a small piece of software that uses computer networks and security holes to replicate itself. A copy of the worm scans the network for another machine that has a specific security hole. It copies itself to the new machine using the security hole, and then starts replicating from there, as well.
• Trojan horses - A Trojan horse is simply a computer program, which claims to do one thing but instead does damage such as erase your hard disk when you run it. Trojan horses have no way to replicate automatically.

Anti-virus software and other countermeasures

There are many anti-virus software products svailable that can detect and eliminate known viruses. Some virus scanners can also warn a user if a file is likely to contain a virus based on the file type. Some antivirus vendors also claim the effective use of other types of heuristic analysis, which work by examining the contents of the computer's memory (its RAM, and boot sector) and the files stored on fixed or removable drives (hard drives, floppy drives), and comparing those files against a database of known virus "signatures". Some anti-virus programs are able to scan opened files in addition to sent and received emails 'on the fly' in a similar manner. This practice is known as "on-access scanning." Anti-virus software typically does not change the underlying capability of host software to transmit viruses. Anti-virus software must be updated regularly for the latest threats and hoaxes.

Antivirus software typically has the host based version for individual PCs and workstations and the gateway version to protect a network or a subnetwork. Now, antivirus technologies are often combined with other technologies such as anti-spam, anti-spyware, firewalls and intrusion detections to provide broader protection to end users. Anti-virus systems are trationally software solutions. When one system is performing mutiple functions such as scanning virus, spam, spyware and detect and blocking intrusions, the performance becomes one of the main concerns. To increase performance of such integrated gateways and reduce delay of message passing though, many integrated gateway products are migrating from pure software products to a combination of hardware and software. Now, many integrated gateways have achieved line speed at the gigabit or multi-gagabit level.