what is antivirus and how does it works?

It seems like we’re always hearing about some new sort of computer virus, worm or malware designed to obtain or destroy information on our devices. Sadly, some of us have been their unfortunate victims. In fact, according to an FBI survey, major businesses lose $12 million each year dealing with virus incidents. But with the right type of antivirus software, you can protect your device and the information stored in it.

Most people know that you need some kind of antivirus software to protect from computer viruses. There are millions of computer viruses in the wild, and antivirus software intercepts and protects your computer from infection. You know antivirus software runs in the background, but how does it work?

Computer Viruses and their anatomy.

Anyone who can program computer software can create a virus. Viruses are just compiled applications that run on your computer. The only difference between regular software and a virus is that a virus is meant to harm you by crashing your computer, deleting data or even stealing your information.

As with any program, a compiled application is made up of bits. As long as the code doesn’t change, the application compiles into the same sequence of bits each time. This sequence of bits is referred to as a “signature” in the virus world. Viruses create a footprint by keeping the same signature as it passes from computer to computer. Because the virus has the same sequence of bits, antivirus vendors can store the sequence to recognize the virus when it’s stored on your computer.

What makes viruses hard to track are the variants that other people create to add on to existing virus signatures. If you read about the different viruses in the wild, you’ll notice that one virus might have several different names. It’s because people take existing virus code, alter it to their own specifications, compile and distribute it. Because most of the code is similar to the original virus, the new variant has a similar but slightly altered signature.

Virus, Worm, Malware: What’s the Difference?

Because these terms are often used interchangeably, you may wonder what the difference is between a virus, worm, and malware if your computer is having issues. Let’s begin with the basics:

• Virus – a piece of code that is capable of copying itself and typically has a detrimental effect, such as corrupting a system or destroying data on an individual computer. A computer virus operates by inserting or attaching itself to a legitimate program or document that supports macros in order to execute its code.
• Worm – a malware computer program that replicates itself so it can spread to other computers, often, via a network. Almost always causing harm to the network, worms rely on security failures on the target computer in order to initially gain access.
• Malware – also known as malicious software, is a broad term used to refer to viruses, worms, ransomware, Trojan horses, keyloggers, rootkits, spyware, adware, and other malicious software. Malware is designed to disrupt normal computer or mobile operations, gather sensitive information, get access to private computer systems and even to show unwanted advertising.

Symptoms of an Infected Computer

When unprotected devices are infected, they:

• Show popups both online and/or offline.
• Have programs that do not open, run slow or close unexpectedly.
• Have browser(s) that do not display some or any website at all.
• Show the ‘FBI’ or ‘Department of Justice’ screen, it comes up shortly after loading the computer’s operating system.
• Present problems when trying to recognize external hardware.
• Show a blue screen with the error code.

Once your device exhibits the above symptoms, chances are good that it has been affected by a virus, worm or other types of malware and likely needs immediate attention from someone trained in the identification and removal of such.

Antivirus Definitions and Virus Signatures

The virus signature is how an antivirus program can work to defend your computer from malware and ransomware. Antivirus software uses a database of virus signatures and checks executable files for these signatures. For instance, if you double-click “myprogram.exe” and it’s a virus disguised as a harmless program, the antivirus checks the executable file against its database of signatures and blocks the program if it comes up with a match.

Because new viruses pop up every day, antivirus vendors produce definition files you add to your existing antivirus software. When you hear IT people tell you to update the definition files, it’s because you need to add to your antivirus software’s database of virus signatures. Without updated definition files, your antivirus software is unable to recognize new virus signatures and you risk installing malware on your computer.

The disadvantage of having antivirus software run in the background is that it does slow down your computer. If you’ve ever wondered why your computer is slower with antivirus software running, it’s because the software must check executable files against a large number of virus signatures in its database. If you need to run software quickly, it’s best to disable the antivirus software temporarily. For instance, antivirus software can interfere with gaming, so gamers often turn off antivirus software during playtime.

If you don’t install executables often, you can turn off background checks and schedule your antivirus software to run at night when you are away from the computer. However, it’s important that you keep some kind of protection on your computer and manually run a scan each week to check for malware.

Antivirus software will begin by checking your computer programs and comparing them to known types of malware. It will also scan your computer for behaviors that may signal the presence of new, unknown malware. Typically, antivirus software uses all three scanning detection processes:

• Specific Detection – This works by looking for known malware by a specific set of characteristics.
• Generic Detection – This process looks for malware that is variants of known “families,” or malware related by a common codebase.
• Heuristic Detection – This process scans for previously unknown viruses by looking for known suspicious behavior or file structures.

Although the detection tools are highly effective, no antivirus software is failsafe. If you suspect your device has been infected, you should take action to remedy the problem quickly.

So, that's the importance of antivirus.

Be safe!