[attachment=10450]
Types of Anti-Viruses
Anti-virus programs are the most effective means of fighting viruses. But I would like to point out at once that there are no anti-viruses guaranteeing 100 percent protection from viruses. Any declarations about their existence may be considered to be either an advertising trick or a sign of incompetence. Such systems do not exist, because, for each anti-virus algorithm, it is always possible to suggest a virus counter algorithm, making this particular virus invisible for this particular anti-virus (fortunately, the opposite is also true: for any anti-virus algorithm, it is always possible to create an anti-virus). Moreover, the impossibility of the existence of the absolute anti-virus has been mathematically proved based on the theory of finite slot machines - the author of this proof is Fred Cohen.
It is also necessary to pay attention to some terms used in anti-virus program discussion:
False Positive - when an uninfected object (file, sector or system memory) triggers the anti-virus program. The opposite term - False Negative - means that an infected object arrived undetected.
On-demand Scanning - a virus scan starts upon user request. In this mode, the anti-virus program remains inactive until a user invokes it from a command line, batch file or system scheduler.
On-the-fly Scanning - all the objects that are processed in any way (opened, closed, created, read from or written to etc.) are being constantly checked for viruses. In this mode, the anti-virus program is always active, it is a memory resident and checks objects without user request.
Which Anti-Virus Program is Better?
Which anti-virus program is the best? The answer is any program, if no viruses live in your computer and you use only a reliable virus-free software source and no other. However, if you like using new software or games, are an active e-mail user, using Word or exchanging Excel spreadsheets, then you should use some kind of anti-virus protection. Which one exactly - you should decide that for yourself, but there are several points of comparison of different anti-virus programs.
The quality of anti-virus programs is determined by the following points, from the most to least important:
1. Reliability and convenience of work - absence of anti-virus "hang ups" and other technical problems, requiring special technical knowledge from a user.
2. Quality of detection of all major kinds of viruses, scanning inside document files, spreadsheets (Microsoft Word, Excel, Office97), packed and archived files. Absence of false positives. Ability to cure infected objects. For scanners (see below), this means the availability of timely updates, which is the speed of tuning a scanner to new viruses.
3. Availability of anti-virus versions for all the popular platforms (DOS, Windows 3.xx, Windows95, WindowsNT, Novell NetWare, OS/2, Alpha, Linux etc.), not only on-demand scanning, but also scanning on-the-fly capabilities, availability of server versions with possibility for network administration.
4. Speed of work and other useful features, functions, bells and whistles.
Reliability of anti-virus programs is the most important criterion, because even the "absolute anti-virus" may become useless, if it is not able to finish the scanning process and hangs, leaving a portion of your disks and files unchecked, thereby leaving the virus in the system undetected. The anti-virus may also be useless if it demands some special knowledge from a user - most users are likely to simply ignore the anti-virus messages and press [OK] or [Cancel] at random, depending on which button is closer to the mouse cursor at this time. And if the anti-virus asks an ordinary user complicated questions too often, the user will most likely stop running such an anti-virus and even delete it from the disk.
Virus-detection quality is the next item, for quite an obvious reason. Anti-virus programs are called anti-virus, because their main purpose is to detect and remove viruses. Any highly sophisticated anti-virus is useless if it is unable to catch viruses, or does it with low efficiency. For example, if an anti-virus can not detect a certain polymorphic virus with 100% success, then after the system has been infected with this particular virus, such an anti-virus detects only part (say 99%) of all the infected files in a system. As little as 1% of infected files will remain undetected, but when this virus has infiltrated the system again, the anti-virus misses this 1% for the second time, but this time this will be 1% of the 99% left from the previous time, i.e., 1.99%. And so on until all the files become infected with the anti-virus being perfectly happy about it.
Therefore, detection quality is the second most important criterion of anti-virus quality; even more important than its multi-platform availability, various convenient features and so on. However, if an anti-virus with high quality of detection causes lots of false positives, then its level of usefulness drops significantly, because a user has to either delete uninfected files or analyze suspicious files all by himself, or gets used to these frequent false alarms and in the end misses the real virus warning (the boy who cried wolf?).
Multi-platform availability is the next item on the list, because for each OS, only a native for that OS program can make extensive use of these OS features. Non-native anti-viruses are often not as useful or sometimes even destructive. For example the "OneHalf" virus has infected a Windows95 or WindowsNT system. If you use a DOS anti-virus for disk decryption (this virus encrypts disk sectors), the results may be disappointing: the information on a disk will be damaged beyond repair, because Windows95/NT would not allow the anti-virus to use direct sector reads/writes while decrypting sectors, whereas a native Windows95 or NT anti-virus fulfills this task flawlessly.
On-the-fly checking capability is also a rather important feature of an anti-virus. Immediate, forced-virus checking of all incoming files and diskettes gives virtually a 100% guarantee of a virus free system, if, of course, the anti-virus is able to detect the supposed viruses. Anti-viruses capable of continuous file-server health care (for Novell Netware, Windows NT, and recently after massive invasion of macro viruses, also for email servers, that is scanning all the incoming mail) are very useful. If a file server version of an anti-virus contains network administration features, its value increases even more.
The next important criterion is working speed. If full system check requires several hours to complete, it is unlikely that most users are going to run it frequently. Also the slowness of anti-virus does not imply that it catches more viruses or does it better than its faster counterpart. Different anti-viruses utilize different virus scanning algorithms, some being faster and of higher quality while another may be slower and not so of such quality. Everything here depends on the abilities and competence of developers of a particular anti-virus.
Various additional options are last in the anti-virus quality criteria list because very often these options have no effect on overall usefulness. However these additional options make user's life much easier and maybe push him to run anti-virus more often.
Tips on Usage of Anti-Virus Programs
Always see that you have the latest antiviral software version available. If software updates are available, check them for "freshness". Usually new versions of anti-viruses are announced, so it is sufficient to visit the corresponding WWW/ftp/BBS sites.
Anti-virus "nationality" in most cases does not matter, because, at the present time, the processes of virus emigration to other countries and antiviral software immigration is limited only by the speed of the Internet, so both viruses and anti-viruses know no borders.
If a virus has been found on your computer, it is imperative not to panic (for those who "meet" viruses daily, a remark like this may seem funny). Panicing never does any good; thoughtless actions may result in bitter consequences.
If a virus is found in some newly arrived file(s) and has not infiltrated the system yet, there is no reason to worry: just kill the file (or remove the virus with your favorite antiviral program) and you may keep on working. If you have found a virus in several files at once or in the boot sector, the problem becomes more serious, but still it can be resolved - anti-virus developers are not drones.
Once more, you should pay attention to the term "false positive." If in some SINGLE file "living" in your computer system for a long time some single anti-virus has detected a virus, this is most likely a false positive. If this file has been run several times, but the virus still has not crawled to other files, then this is extremely strange. Try to check this file with some other anti-viruses. If all of them keep silent, send this file to the research lab of the company that developed the anti-virus, which was triggered by it.
However, if a virus has really been found in your computer, you should do the following:
1. In the case of a file-virus detection, if the computer is connected to a network, you should disconnect it from the network and inform the system administrator. If the virus has not yet infiltrated the network, this will protect the server and other workstations from virus attack. If the virus has already infected the server, disconnection from the network will not stop the virus from infiltrating into your computer again after its treatment. Reconnection to the network must be done only after all the servers and workstations have been cured.
If a boot virus has been found, you should not disconnect your computer from the network: viruses of this kind do not spread over it (except file-boot viruses, of course).
If the computer is infected with a macro-virus, then instead of disconnecting from network, it is enough to make sure that the corresponding editor (Word/Excel) is inactive on any computer.
2. If a file or boot virus has been detected, you should make sure that either the virus is non-resident, or the resident part of it has been disarmed: when started, some (but not all) anti-viruses automatically disable resident viruses in memory. Removal of a virus from the memory is necessary to stop its spreading. When scanning files, anti-viruses open them; many resident viruses intercept this event and infect the files being opened. As a result, the majority is infected because the virus has not been removed from memory yet. The same thing may happen in the case of boot viruses - all the diskettes being checked may become infected.
If the anti-virus you use does not remove viruses from memory, you should reboot the computer from a known uninfected and well-written, protected system diskette. You should do a "cold" boot (by pressing "Reset" or power "off/on"), because several viruses "survive" after a "warm" boot. Some viruses apply a technique allowing for their survival even after the "cold" boot (see the "Ugly" virus for example), so you should also check the item "boot sequence A:, C:" in the machine's BIOS to ensure DOS boots from the system diskette and not from infected hard drive.
In addition to resident/non-resident capabilities, it is useful to make yourself acquainted with other features of the virus: types of files it infects, its effects etc. The only known source of such information, containing data of this kind on virtually all known viruses, is "The AVP Virus Encyclopedia."
3. With the help of the anti-viral program, you should restore the infected files and check them for functionality. At the same time or before treatment, you should backup the infected files and print/save the anti-virus log somewhere. This is necessary for restoring files in case the treatment proves to be unsuccessful due to an error in anti-virus-treatment module, or because of an inability of this anti-virus to cure this kind of virus. In this case, you will have to resort to the services of some other anti-virus.
It is much more reliable, of course, to simply restore the backed up files (if available), but, still, you will need to resort to an anti-virus - what if all the copies of the virus haven't been destroyed, or some backed up files are infected, too?
It is worth mentioning that the quality of file restoration by many antiviral programs leaves much to be desired. Many popular anti- viruses often irreversibly damage files instead of curing them. Therefore, if file loss undesirable, you should execute all the previous recommendations completely.
In the case of a boot virus, it is necessary to check all the diskettes to see whether they are bootable (i.e., contain DOS files) or not. Even a completely blank diskette may become a source of viral infection - it is enough to forget it in the drive and reboot (of course, if a diskette boot is enabled in BIOS).
Besides the above-mentioned items, you should pay special attention to the cleanness of modules, compressed with utilities like LZEXE, PKLITE or DIET, files inside archives (ZIP, ARC, ICE, ARJ, etc.) and self-extracting data files (created by the likes of ZIP2EXE). If you accidentally pack a virus in an infected file, it will be virtually impossible to detect and remove the virus from it without unpacking. In this case, a situation in which all the antiviral programs, unable to scan inside archives, report that all disks are virus free (however, after some time, the virus re-emerges) will become typical.
Colonies of viruses may infiltrate backup copies of software, too. Moreover, archives and back-up copies are the main source of long known viruses. A virus may "sit" in a distribution copy of some software for ages and then suddenly appear after software installation on a new computer.
Nobody can guarantee removal of all copies of a computer virus, because a file virus may attack not only executables, but also overlay modules not having COM or EXE extensions. A boot virus may remain on some diskettes and appear suddenly after an attempt to boot from it. Therefore, it is sensible to use some resident anti-virus scanner continuously for some time after virus removal (not to mention that it's better to a use scanner at all times).