![ClamTk 5](https://upload.wikimedia.org/wikipedia/commons/5/5b/ClamTk_5.27.png)
Antivirus software (abbreviated to AV software), also known as anti-malware, is a
computer program
A computer program is a sequence or set of instructions in a programming language for a computer to execute. Computer programs are one component of software, which also includes documentation and other intangible components.
A computer program ...
used to prevent, detect, and remove
malware.
Antivirus software was originally developed to detect and remove
computer viruses, hence the name. However, with the proliferation of other
malware, antivirus software started to protect from other computer threats. In particular, modern antivirus software can protect users from malicious
browser helper objects (BHOs),
browser hijackers,
ransomware,
keyloggers
Keystroke logging, often referred to as keylogging or keyboard capturing, is the action of recording (logging) the keys struck on a keyboard, typically covertly, so that a person using the keyboard is unaware that their actions are being monitored ...
,
backdoors,
rootkits
A rootkit is a collection of software, computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence o ...
,
trojan horses
The Trojan Horse was a wooden horse said to have been used by the Greeks during the Trojan War to enter the city of Troy and win the war. The Trojan Horse is not mentioned in Homer's ''Iliad'', with the poem ending before the war is concluded, ...
,
worms Worms may refer to:
*Worm, an invertebrate animal with a tube-like body and no limbs
Places
*Worms, Germany
Worms () is a city in Rhineland-Palatinate, Germany, situated on the Upper Rhine about south-southwest of Frankfurt am Main. It had ...
, malicious
LSPs,
dialers,
fraud tools,
adware
Adware, often called advertising-supported software by its developers, is software that generates revenue for its developer by automatically generating online advertisements in the user interface of the software or on a screen presented to the ...
, and
spyware
Spyware (a portmanteau for spying software) is software with malicious behaviour that aims to gather information about a person or organization and send it to another entity in a way that harms the user—for example, by violating their priva ...
. Some products also include protection from other
computer threats, such as infected and malicious
URLs
A Uniform Resource Locator (URL), colloquially termed as a web address, is a reference to a web resource that specifies its location on a computer network and a mechanism for retrieving it. A URL is a specific type of Uniform Resource Identifi ...
,
spam,
scam
A confidence trick is an attempt to defraud a person or group after first gaining their trust. Confidence tricks exploit victims using their credulity, naïveté, compassion, vanity, confidence, irresponsibility, and greed. Researchers hav ...
and
phishing
Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwa ...
attacks,
online identity
Internet identity (IID), also online identity or internet persona, is a social identity that an Internet user establishes in online communities and websites. It may also be an actively constructed presentation of oneself. Although some people choo ...
(privacy),
online banking
Online banking, also known as internet banking, web banking or home banking, is an electronic payment system that enables customers of a bank or other financial institution to conduct a range of financial transactions through the financial ins ...
attacks,
social engineering techniques,
advanced persistent threat
An advanced persistent threat (APT) is a stealthy threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may ...
(APT), and
botnet
A botnet is a group of Internet-connected devices, each of which runs one or more bots. Botnets can be used to perform Distributed Denial-of-Service (DDoS) attacks, steal data, send spam, and allow the attacker to access the device and its conn ...
DDoS
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connec ...
attacks.
History
1949–1980 period (pre-antivirus days)
Although the roots of the
computer virus date back as early as 1949, when the Hungarian scientist
John von Neumann
John von Neumann (; hu, Neumann János Lajos, ; December 28, 1903 – February 8, 1957) was a Hungarian-American mathematician, physicist, computer scientist, engineer and polymath. He was regarded as having perhaps the widest cove ...
published the ''"Theory of self-reproducing automata"'', the first known
computer virus appeared in 1971 and was dubbed the "
Creeper virus
Creeper was the first computer worm, while Reaper was the first antivirus software, designed to eliminate Creeper.
Creeper
Creeper was an experimental computer program written by Bob Thomas at BBN in 1971. Its original iteration was designed to ...
". This computer virus infected
Digital Equipment Corporation
Digital Equipment Corporation (DEC ), using the trademark Digital, was a major American company in the computer industry from the 1960s to the 1990s. The company was co-founded by Ken Olsen and Harlan Anderson in 1957. Olsen was president un ...
's (
DEC)
PDP-10
Digital Equipment Corporation (DEC)'s PDP-10, later marketed as the DECsystem-10, is a mainframe computer family manufactured beginning in 1966 and discontinued in 1983. 1970s models and beyond were marketed under the DECsystem-10 name, espec ...
mainframe computers running the
TENEX operating system.
[From the first email to the first YouTube video: a definitive internet history](_blank)
. Tom Meltzer and Sarah Phillips. ''The Guardian
''The Guardian'' is a British daily newspaper. It was founded in 1821 as ''The Manchester Guardian'', and changed its name in 1959. Along with its sister papers ''The Observer'' and ''The Guardian Weekly'', ''The Guardian'' is part of the Gu ...
''. October 23, 2009
The Creeper virus was eventually deleted by a program created by
Ray Tomlinson
Raymond Samuel Tomlinson (April 23, 1941 – March 5, 2016) was an American computer programmer who implemented the first email program on the ARPANET system, the precursor to the Internet, in 1971; It was the first system able to send mail be ...
and known as "
The Reaper".
Some people consider "The Reaper" the first antivirus software ever written – it may be the case, but it is important to note that the Reaper was actually a virus itself specifically designed to remove the Creeper virus.
The Creeper virus was followed by several other viruses. The first known that appeared "in the wild" was "
Elk Cloner
Elk Cloner is one of the first known microcomputer viruses that spread "in the wild", ''i.e.'', outside the computer system or laboratory in which it was written. It attached itself to the Apple II operating system and spread by floppy disk. It w ...
", in 1981, which infected
Apple II computers.
In 1983, the term ''"computer virus"'' was coined by
Fred Cohen
Frederick B. Cohen (born 1956) is an American computer scientist and best known as the inventor of computer virus defense techniques. He gave the definition of "computer virus". Cohen is best known for his pioneering work on computer viruses, t ...
in one of the first ever published academic papers on
computer viruses. Cohen used the term ''"computer virus"'' to describe programs that: ''"affect other computer programs by modifying them in such a way as to include a (possibly evolved) copy of itself."'' (note that a more recent definition of
computer virus has been given by the Hungarian security researcher
Péter Szőr: ''"a code that recursively replicates a possibly evolved copy of itself"'').
The first
IBM PC compatible
IBM PC compatible computers are similar to the original IBM Personal Computer, IBM PC, IBM Personal Computer XT, XT, and IBM Personal Computer/AT, AT, all from computer giant IBM, that are able to use the same software and expansion cards. Such ...
"in the wild" computer virus, and one of the first real widespread infections, was "
Brain
A brain is an organ that serves as the center of the nervous system in all vertebrate and most invertebrate animals. It is located in the head, usually close to the sensory organs for senses such as vision. It is the most complex organ in a ve ...
" in 1986. From then, the number of viruses has grown exponentially.
Most of the computer viruses written in the early and mid-1980s were limited to self-reproduction and had no specific damage routine built into the code. That changed when more and more programmers became acquainted with computer virus programming and created viruses that manipulated or even destroyed data on infected computers.
Before
internet
The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...
connectivity was widespread, computer viruses were typically spread by infected
floppy disks. Antivirus software came into use, but was updated relatively infrequently. During this time, virus checkers essentially had to check executable files and the boot sectors of floppy disks and hard disks. However, as internet usage became common, viruses began to spread online.
1980–1990 period (early days)
There are competing claims for the innovator of the first antivirus product. Possibly, the first publicly documented removal of an "in the wild"
computer virus (i.e. the "Vienna virus") was performed by
Bernd Fix
Bernd Fix (born 19 March 1962 in Wittingen, Lower Saxony) is a German hacker and computer security expert.
Biography
After final secondary-school examination from Gymnasium Hankensbüttel in 1981, Bernd Fix studied Astrophysics and Philos ...
in 1987.
In 1987, Andreas Lüning and Kai Figge, who founded
G Data Software
G Data CyberDefense AG (until September 2019 ''G Data Software AG'') is a German software company that focuses on computer security. The company was founded in 1985 and is headquartered in Bochum. They are known for being the creators o ...
in 1985, released their first antivirus product for the
Atari ST platform.
In 1987, the ''Ultimate Virus Killer (UVK)'' was also released.
This was the de facto industry standard virus killer for the
Atari ST and
Atari Falcon
The Atari Falcon030 (usually shortened to Atari Falcon), released in 1992, was the final personal computer product from Atari Corporation. A high-end model of the Atari ST line, the machine is based on a Motorola 68030 CPU and a Motorola 56001 d ...
, the last version of which (version 9.0) was released in April 2004. In 1987, in the United States,
John McAfee
John David McAfee ( ; 18 September 1945 – 23 June 2021) was a British-American computer programmer, businessman, and two-time presidential candidate who unsuccessfully sought the Libertarian Party nomination for president of the United States ...
founded the
McAfee
McAfee Corp. ( ), formerly known as McAfee Associates, Inc. from 1987 to 1997 and 2004 to 2014, Network Associates Inc. from 1997 to 2004, and Intel Security Group from 2014 to 2017, is an American global computer security software company head ...
company (was part of
Intel Security) and, at the end of that year, he released the first version of
VirusScan. Also in 1987 (in
Czechoslovakia
, rue, Чеськословеньско, , yi, טשעכאסלאוואקיי,
, common_name = Czechoslovakia
, life_span = 1918–19391945–1992
, p1 = Austria-Hungary
, image_p1 ...
), Peter Paško, Rudolf Hrubý, and Miroslav Trnka created the first version of
NOD antivirus.
In 1987, Fred Cohen wrote that ''there is no algorithm that can perfectly detect all possible computer viruses''.
[Cohen, Fred]
An Undetectable Computer Virus (Archived)
1987, IBM
Finally, at the end of 1987, the first two
heuristic
A heuristic (; ), or heuristic technique, is any approach to problem solving or self-discovery that employs a practical method that is not guaranteed to be optimal, perfect, or rational, but is nevertheless sufficient for reaching an immediate ...
antivirus utilities were released: ''Flushot Plus'' by
Ross Greenberg and ''Anti4us'' by Erwin Lanting. In his
O'Reilly
O'Reilly ( ga, Ó Raghallaigh) is a group of families, ultimately all of Irish Gaelic origin, who were historically the kings of East Bréifne in what is today County Cavan. The clan were part of the Connachta's Uí Briúin Bréifne kindred a ...
book, ''Malicious Mobile Code: Virus Protection for Windows'', Roger Grimes described Flushot Plus as "the first holistic program to fight malicious mobile code (MMC)."
However, the kind of heuristic used by early AV engines was totally different from those used today. The first product with a heuristic engine resembling modern ones was
F-PROT
FRISK Software International (established in 1993) was an Icelandic software company that developed F-Prot antivirus and F-Prot AVES antivirus and anti-spam service. The company was founded in 1993. It was acquired by Cyren in 2012.
History
Th ...
in 1991. Early heuristic engines were based on dividing the binary into different sections: data section, code section (in a legitimate binary, it usually starts always from the same location). Indeed, the initial viruses re-organized the layout of the sections, or overrode the initial portion of a section in order to jump to the very end of the file where malicious code was located—only going back to resume execution of the original code. This was a very specific pattern, not used at the time by any legitimate software, which represented an elegant heuristic to catch suspicious code. Other kinds of more advanced heuristics were later added, such as suspicious section names, incorrect header size, regular expressions, and partial pattern in-memory matching.
In 1988, the growth of antivirus companies continued. In Germany, Tjark Auerbach founded
Avira
Avira Operations GmbH is a German multinational computer security software company mainly known for their Avira Free Security antivirus software. Avira was founded in 2006, but the antivirus application has been under active development since ...
(''H+BEDV'' at the time) and released the first version of ''
AntiVir
Avira Operations GmbH is a German multinational computer security software company mainly known for their Avira Free Security antivirus software. Avira was founded in 2006, but the antivirus application has been under active development since ...
'' (named ''"Luke Filewalker"'' at the time). In
Bulgaria
Bulgaria (; bg, България, Bǎlgariya), officially the Republic of Bulgaria,, ) is a country in Southeast Europe. It is situated on the eastern flank of the Balkans, and is bordered by Romania to the north, Serbia and North Macedo ...
, Vesselin Bontchev released his first freeware antivirus program (he later joined
FRISK Software). Also Frans Veldman released the first version of
ThunderByte Antivirus
ThunderBYTE Anti-Virus (TBAV) was an early antivirus software product. It was created by Dutchman Frans Veldman in 1988, and published by his company, ESaSS B.V. It was mainly designed for DOS, but there were also versions supporting Microsof ...
, also known as ''TBAV'' (he sold his company to
Norman Safeground in 1998). In
Czechoslovakia
, rue, Чеськословеньско, , yi, טשעכאסלאוואקיי,
, common_name = Czechoslovakia
, life_span = 1918–19391945–1992
, p1 = Austria-Hungary
, image_p1 ...
,
Pavel Baudiš
Pavel Baudiš (born 15 May 1960) is a Czech software engineer, entrepreneur and the co-founder of Avast along with Eduard Kučera. As of 2022, he is the 8th wealthiest person in the Czech Republic, with a net worth of more than 54.5 billion Czech ...
and Eduard Kučera started
avast! (at the time ''ALWIL Software'') and released their first version of avast! antivirus. In June 1988, in
South Korea
South Korea, officially the Republic of Korea (ROK), is a country in East Asia, constituting the southern part of the Korean Peninsula and sharing a land border with North Korea. Its western border is formed by the Yellow Sea, while its eas ...
,
Ahn Cheol-Soo
Ahn Cheol-soo ( ; born 26 February 1962) is a South Korean politician, medical doctor, businessperson, and software entrepreneur. He currently serves as a member of the National Assembly as part of the conservative People Power Party.
Pri ...
released its first antivirus software, called ''V1'' (he founded AhnLab later in 1995). Finally, in the Autumn 1988, in United Kingdom, Alan Solomon founded S&S International and created his ''
Dr. Solomon's Anti-Virus Toolkit'' (although he launched it commercially only in 1991 – in 1998 Solomon's company was acquired by
McAfee
McAfee Corp. ( ), formerly known as McAfee Associates, Inc. from 1987 to 1997 and 2004 to 2014, Network Associates Inc. from 1997 to 2004, and Intel Security Group from 2014 to 2017, is an American global computer security software company head ...
). In November 1988 a professor at the Panamerican University in Mexico City named Alejandro E. Carriles copyrighted the first antivirus software in Mexico under the name "Byte Matabichos" (Byte Bugkiller) to help solve the rampant virus infestation among students.
Also in 1988, a mailing list named VIRUS-L
was started on the
BITNET/
EARN network where new viruses and the possibilities of detecting and eliminating viruses were discussed. Some members of this mailing list were: Alan Solomon,
Eugene Kaspersky
Yevgeny Valentinovich Kaspersky (Russian: Евгений Валентинович Касперский; born 4 October 1965) is a Russian cybersecurity expert and the CEO of Kaspersky Lab, an IT security company with 4,000 employees. He co-found ...
(
Kaspersky Lab
Kaspersky Lab (; Russian: Лаборатория Касперского, tr. ''Laboratoriya Kasperskogo'') is a Russian multinational cybersecurity and anti-virus provider headquartered in Moscow, Russia, and operated by a holding company in th ...
),
Friðrik Skúlason
FRISK Software International (established in 1993) was an Icelandic software company that developed F-Prot antivirus and F-Prot AVES antivirus and anti-spam service. The company was founded in 1993. It was acquired by Cyren in 2012.
History
Th ...
(
FRISK Software),
John McAfee
John David McAfee ( ; 18 September 1945 – 23 June 2021) was a British-American computer programmer, businessman, and two-time presidential candidate who unsuccessfully sought the Libertarian Party nomination for president of the United States ...
(
McAfee
McAfee Corp. ( ), formerly known as McAfee Associates, Inc. from 1987 to 1997 and 2004 to 2014, Network Associates Inc. from 1997 to 2004, and Intel Security Group from 2014 to 2017, is an American global computer security software company head ...
), Luis Corrons (
Panda Security
Panda Security is a Spanish cybersecurity software company that specializes in creating products for IT security. Panda Security started with antivirus software, and the company now also provides and develops cybersecurity software. This includ ...
),
Mikko Hyppönen
Mikko Hermanni Hyppönen (; born 13 October 1969) is a Finnish computer security expert, speaker and author. He is known for the Hyppönen Law about IoT security, which states that whenever an appliance is described as being "smart", it is vulner ...
(
F-Secure
F-Secure Corporation is a global cyber security and privacy company, which has its headquarters in Helsinki, Finland.
The company has offices in Denmark, Finland, France, Germany, India, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Sweden, ...
),
Péter Szőr, Tjark Auerbach (
Avira
Avira Operations GmbH is a German multinational computer security software company mainly known for their Avira Free Security antivirus software. Avira was founded in 2006, but the antivirus application has been under active development since ...
) and Vesselin Bontchev (
FRISK Software).
In 1989, in
Iceland
Iceland ( is, Ísland; ) is a Nordic island country in the North Atlantic Ocean and in the Arctic Ocean. Iceland is the most sparsely populated country in Europe. Iceland's capital and largest city is Reykjavík, which (along with its s ...
,
Friðrik Skúlason
FRISK Software International (established in 1993) was an Icelandic software company that developed F-Prot antivirus and F-Prot AVES antivirus and anti-spam service. The company was founded in 1993. It was acquired by Cyren in 2012.
History
Th ...
created the first version of
F-PROT Anti-Virus (he founded
FRISK Software only in 1993). Meanwhile in the United States,
Symantec (founded by Gary Hendrix in 1982) launched its first ''
Symantec antivirus for Macintosh'' (SAM). SAM 2.0, released March 1990, incorporated technology allowing users to easily update SAM to intercept and eliminate new viruses, including many that didn't exist at the time of the program's release.
In the end of the 1980s, in United Kingdom, Jan Hruska and Peter Lammer founded the security firm
Sophos and began producing their first antivirus and encryption products. In the same period, in Hungary, also
VirusBuster was founded (which has recently being incorporated by
Sophos).
1990–2000 period (emergence of the antivirus industry)
In 1990, in Spain, Mikel Urizarbarrena founded
Panda Security
Panda Security is a Spanish cybersecurity software company that specializes in creating products for IT security. Panda Security started with antivirus software, and the company now also provides and develops cybersecurity software. This includ ...
(''Panda Software'' at the time). In Hungary, the security researcher
Péter Szőr released the first version of ''Pasteur'' antivirus. In Italy, Gianfranco Tonello created the first version of
VirIT eXplorer antivirus, then founded
TG Soft TG or Tg may stand for:
Arts and entertainment Gaming
* The Gathering (computer party), the second largest computer party in the world
* Travian Games, a German video game development and publisher company
Television
* Telegiornale (disambiguatio ...
one year later.
In 1990, the
Computer Antivirus Research Organization
Caro may refer to: Places
* Caro, Michigan, United States
* Caro, Morbihan, France
* Çaro, Pyrénées-Atlantiques, France
Other uses
* Caro (given name), including a list of people with the given name
* Caro (surname), including a list of peo ...
(
CARO
Caro may refer to: Places
* Caro, Michigan, United States
* Caro, Morbihan, France
* Çaro, Pyrénées-Atlantiques, France
Other uses
* Caro (given name), including a list of people with the given name
* Caro (surname), including a list of peo ...
) was founded. In 1991, CARO released the ''"Virus Naming Scheme"'', originally written by
Friðrik Skúlason
FRISK Software International (established in 1993) was an Icelandic software company that developed F-Prot antivirus and F-Prot AVES antivirus and anti-spam service. The company was founded in 1993. It was acquired by Cyren in 2012.
History
Th ...
and Vesselin Bontchev. Although this naming scheme is now outdated, it remains the only existing standard that most computer security companies and researchers ever attempted to adopt.
CARO
Caro may refer to: Places
* Caro, Michigan, United States
* Caro, Morbihan, France
* Çaro, Pyrénées-Atlantiques, France
Other uses
* Caro (given name), including a list of people with the given name
* Caro (surname), including a list of peo ...
members includes: Alan Solomon, Costin Raiu, Dmitry Gryaznov,
Eugene Kaspersky
Yevgeny Valentinovich Kaspersky (Russian: Евгений Валентинович Касперский; born 4 October 1965) is a Russian cybersecurity expert and the CEO of Kaspersky Lab, an IT security company with 4,000 employees. He co-found ...
,
Friðrik Skúlason
FRISK Software International (established in 1993) was an Icelandic software company that developed F-Prot antivirus and F-Prot AVES antivirus and anti-spam service. The company was founded in 1993. It was acquired by Cyren in 2012.
History
Th ...
,
Igor Muttik
Igor Muttik (born 1962 in Russia) is a computer security expert, researcher and inventor.
Career
Igor Muttik is a Senior Principal Research Architect with McAfee which is part of Intel Corporation since 2011. He started researching computer malwar ...
,
Mikko Hyppönen
Mikko Hermanni Hyppönen (; born 13 October 1969) is a Finnish computer security expert, speaker and author. He is known for the Hyppönen Law about IoT security, which states that whenever an appliance is described as being "smart", it is vulner ...
, Morton Swimmer, Nick FitzGerald,
Padgett Peterson
Caro may refer to: Places
* Caro, Michigan, United States
* Caro, Morbihan, France
* Çaro, Pyrénées-Atlantiques, France
Other uses
* Caro (given name), including a list of people with the given name
* Caro (surname), including a list of peo ...
, Peter Ferrie, Righard Zwienenberg and Vesselin Bontchev.
In 1991, in the United States,
Symantec released the first version of
Norton AntiVirus
Norton AntiVirus is an anti-virus or anti-malware software product founded by Peter Norton, developed and distributed by Gen Digital since 1990 as part of its Norton family of computer security products. It uses signatures and heuristics to i ...
. In the same year, in the
Czech Republic
The Czech Republic, or simply Czechia, is a landlocked country in Central Europe. Historically known as Bohemia, it is bordered by Austria to the south, Germany to the west, Poland to the northeast, and Slovakia to the southeast. The ...
, Jan Gritzbach and Tomáš Hofer founded
AVG Technologies (''Grisoft'' at the time), although they released the first version of their ''Anti-Virus Guard'' (AVG) only in 1992. On the other hand, in
Finland
Finland ( fi, Suomi ; sv, Finland ), officially the Republic of Finland (; ), is a Nordic country in Northern Europe. It shares land borders with Sweden to the northwest, Norway to the north, and Russia to the east, with the Gulf of B ...
,
F-Secure
F-Secure Corporation is a global cyber security and privacy company, which has its headquarters in Helsinki, Finland.
The company has offices in Denmark, Finland, France, Germany, India, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Sweden, ...
(founded in 1988 by Petri Allas and Risto Siilasmaa – with the name of Data Fellows) released the first version of their antivirus product.
F-Secure
F-Secure Corporation is a global cyber security and privacy company, which has its headquarters in Helsinki, Finland.
The company has offices in Denmark, Finland, France, Germany, India, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Sweden, ...
claims to be the first antivirus firm to establish a presence on the World Wide Web.
In 1991, the
European Institute for Computer Antivirus Research (EICAR) was founded to further antivirus research and improve development of antivirus software.
In 1992, in Russia, Igor Danilov released the first version of ''SpiderWeb'', which later became
Dr. Web.
In 1994,
AV-TEST
AV-TEST is an independent organization which evaluates and rates antivirus and security suite software for Microsoft Windows and Android operating systems, according to a variety of criteria. The organisation is based in Magdeburg, Germany.
Ever ...
reported that there were 28,613 unique malware samples (based on MD5) in their database.
[ n 1994, AV-Test.org reported 28,613 unique malware samples (based on MD5). "A Brief History of Malware; The First 25 Years"/ref>
Over time other companies were founded. In 1996, in ]Romania
Romania ( ; ro, România ) is a country located at the crossroads of Central, Eastern, and Southeastern Europe. It borders Bulgaria to the south, Ukraine to the north, Hungary to the west, Serbia to the southwest, Moldova to the east, and ...
, Bitdefender
Bitdefender is a Romanian cybersecurity technology company headquartered in Bucharest, Romania, with offices in the United States, Europe, Australia and the Middle East.
The company was founded in 2001 by the current CEO and main shareholder, ...
was founded and released the first version of ''Anti-Virus eXpert'' (AVX). In 1997, in Russia, Eugene Kaspersky
Yevgeny Valentinovich Kaspersky (Russian: Евгений Валентинович Касперский; born 4 October 1965) is a Russian cybersecurity expert and the CEO of Kaspersky Lab, an IT security company with 4,000 employees. He co-found ...
and Natalya Kaspersky
Natalya Ivanovna Kasperskaya (russian: Наталья Ивановна Касперская; born 5 February 1966 in Moscow, Soviet Union)—who, in the West, uses as her surname the masculine form ''Kaspersky''—is a Russian IT entrepreneur ...
co-founded security firm Kaspersky Lab
Kaspersky Lab (; Russian: Лаборатория Касперского, tr. ''Laboratoriya Kasperskogo'') is a Russian multinational cybersecurity and anti-virus provider headquartered in Moscow, Russia, and operated by a holding company in th ...
.
In 1996, there was also the first "in the wild" Linux
Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, w ...
virus, known as ''" Staog"''.
In 1999, AV-TEST
AV-TEST is an independent organization which evaluates and rates antivirus and security suite software for Microsoft Windows and Android operating systems, according to a variety of criteria. The organisation is based in Magdeburg, Germany.
Ever ...
reported that there were 98,428 unique malware samples (based on MD5) in their database.
2000–2005 period
In 2000, Rainer Link and Howard Fuhs started the first open source antivirus engine, called ''OpenAntivirus Project''.
In 2001, Tomasz Kojm released the first version of ClamAV
Clam AntiVirus (ClamAV) is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses. It was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, macOS, OpenVM ...
, the first ever open source antivirus engine to be commercialised. In 2007, ClamAV
Clam AntiVirus (ClamAV) is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses. It was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, macOS, OpenVM ...
was bought by Sourcefire
Sourcefire, Inc was a technology company that developed network security hardware and software. The company's Firepower network security appliances were based on Snort, an open-source intrusion detection system (IDS). Sourcefire was acquired ...
, which in turn was acquired by Cisco Systems
Cisco Systems, Inc., commonly known as Cisco, is an American-based multinational digital communications technology conglomerate corporation headquartered in San Jose, California. Cisco develops, manufactures, and sells networking hardware, ...
in 2013.
In 2002, in United Kingdom, Morten Lund and Theis Søndergaard co-founded the antivirus firm BullGuard.
In 2005, AV-TEST
AV-TEST is an independent organization which evaluates and rates antivirus and security suite software for Microsoft Windows and Android operating systems, according to a variety of criteria. The organisation is based in Magdeburg, Germany.
Ever ...
reported that there were 333,425 unique malware samples (based on MD5) in their database.
2005–2014 period
In 2007, AV-TEST
AV-TEST is an independent organization which evaluates and rates antivirus and security suite software for Microsoft Windows and Android operating systems, according to a variety of criteria. The organisation is based in Magdeburg, Germany.
Ever ...
reported a number of 5,490,960 new unique malware samples (based on MD5) only for that year. In 2012 and 2013, antivirus firms reported a new malware samples range from 300,000 to over 500,000 per day.
Over the years it has become necessary for antivirus software to use several different strategies (e.g. specific email and network protection or low level modules) and detection algorithms, as well as to check an increasing variety of files, rather than just executables, for several reasons:
* Powerful macros used in word processor
A word processor (WP) is a device or computer program that provides for input, editing, formatting, and output of text, often with some additional features.
Early word processors were stand-alone devices dedicated to the function, but current ...
applications, such as Microsoft Word
Microsoft Word is a word processor, word processing software developed by Microsoft. It was first released on October 25, 1983, under the name ''Multi-Tool Word'' for Xenix systems. Subsequent versions were later written for several other pla ...
, presented a risk. Virus writers could use the macros to write viruses embedded within documents. This meant that computers could now also be at risk from infection by opening documents with hidden attached macros.
* The possibility of embedding executable objects inside otherwise non-executable file formats can make opening those files a risk.
* Later email programs, in particular Microsoft's Outlook Express
Outlook Express, formerly known as Microsoft Internet Mail and News, is a discontinued email and news client included with Internet Explorer versions 3.0 through to 6.0. As such, it was bundled with several versions of Microsoft Windows, from ...
and Outlook
Outlook or The Outlook may refer to:
Computing
* Microsoft Outlook, an e-mail and personal information management software product from Microsoft
* Outlook.com, a web mail service from Microsoft
* Outlook on the web, a suite of web applications ...
, were vulnerable to viruses embedded in the email body itself. A user's computer could be infected by just opening or previewing a message.
In 2005, F-Secure
F-Secure Corporation is a global cyber security and privacy company, which has its headquarters in Helsinki, Finland.
The company has offices in Denmark, Finland, France, Germany, India, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Sweden, ...
was the first security firm that developed an Anti-Rootkit technology, called ''BlackLight''.
Because most users are usually connected to the Internet on a continual basis, Jon Oberheide first proposed a Cloud-based
Cloud computing is the on-demand availability of computer system resources, especially data storage (cloud storage) and computing power, without direct active management by the user. Large clouds often have functions distributed over mult ...
antivirus design in 2008.
In February 2008 McAfee Labs added the industry-first cloud-based anti-malware functionality to VirusScan under the name Artemis. It was tested by AV-Comparatives
AV-Comparatives is an Austrian independent organization that tests and assesses antivirus software, regularly releasing charts and reports that are freely available to the public and the media. Antivirus vendors have to meet various requirements r ...
in February 2008 and officially unveiled in August 2008 in McAfee VirusScan.
Cloud AV created problems for comparative testing of security software – part of the AV definitions was out of testers control (on constantly updated AV company servers) thus making results non-repeatable. As a result, Anti-Malware Testing Standards Organisation (AMTSO) started working on method of testing cloud products which was adopted on May 7, 2009.
In 2011, AVG introduced a similar cloud service, called Protective Cloud Technology.
2014–present (rise of next-gen)
Following the 2013 release of the APT 1 report from Mandiant
Mandiant is an American cybersecurity firm and a subsidiary of Google. It rose to prominence in February 2013 when it released a report directly implicating China in cyber espionage. In December 2013, Mandiant was acquired by FireEye for $1 bi ...
, the industry has seen a shift towards signature-less approaches to the problem capable of detecting and mitigating zero-day attacks. Numerous approaches to address these new forms of threats have appeared, including behavioral detection, artificial intelligence, machine learning, and cloud-based file detonation. According to Gartner, it is expected the rise of new entrants, such Carbon Black
Carbon black (subtypes are acetylene black, channel black, furnace black, lamp black and thermal black) is a material produced by the incomplete combustion of coal and coal tar, vegetable matter, or petroleum products, including fuel oil, fluid ...
, Cylance
Cylance Inc. Is an American software firm based in Irvine, California that developed antivirus programs and other kinds of computer software that sought to prevent, rather than reactively detect, viruses and malware. Cyber Secure India describ ...
and Crowdstrike
CrowdStrike Holdings, Inc. is an American cybersecurity technology company based in Austin, Texas. It provides cloud workload and endpoint security, threat intelligence, and cyberattack response services. The company has been involved in inves ...
will force EPP incumbents into a new phase of innovation and acquisition. One method from Bromium involves micro-virtualization to protect desktops from malicious code execution initiated by the end user. Another approach from SentinelOne and Carbon Black
Carbon black (subtypes are acetylene black, channel black, furnace black, lamp black and thermal black) is a material produced by the incomplete combustion of coal and coal tar, vegetable matter, or petroleum products, including fuel oil, fluid ...
focuses on behavioral detection by building a full context around every process execution path in real time, while Cylance
Cylance Inc. Is an American software firm based in Irvine, California that developed antivirus programs and other kinds of computer software that sought to prevent, rather than reactively detect, viruses and malware. Cyber Secure India describ ...
leverages an artificial intelligence model based on machine learning. Increasingly, these signature-less approaches have been defined by the media and analyst firms as "next-generation" antivirus and are seeing rapid market adoption as certified antivirus replacement technologies by firms such as Coalfire and DirectDefense. In response, traditional antivirus vendors such as Trend Micro
is an American-Japanese multinational cyber security software company with global headquarters in Tokyo, Japan and Irving, Texas, United State.Other regional headquarters and R&D centers are located around East Asia, Southeast Asia, Europe, and ...
, Symantec and Sophos have responded by incorporating "next-gen" offerings into their portfolios as analyst firms such as Forrester and Gartner
Gartner, Inc is a technological research and consulting firm based in Stamford, Connecticut that conducts research on technology and shares this research both through private consulting as well as executive programs and conferences. Its client ...
have called traditional signature-based antivirus "ineffective" and "outdated".
Identification methods
One of the few solid theoretical results in the study of computer viruses is Frederick B. Cohen's 1987 demonstration that there is no algorithm that can perfectly detect all possible viruses. However, using different layers of defense, a good detection rate may be achieved.
There are several methods which antivirus engines can use to identify malware:
* Sandbox detection: a particular behavioural-based detection technique that, instead of detecting the behavioural fingerprint at run time, it executes the programs in a virtual environment
A virtual environment is a networked application that allows a user to interact with both the computing environment and the work of other users. Email, chat
Chat or chats may refer to:
Communication
* Conversation, particularly casual
* Onlin ...
, logging what actions the program performs. Depending on the actions logged, the antivirus engine can determine if the program is malicious or not. If not, then, the program is executed in the real environment. Albeit this technique has shown to be quite effective, given its heaviness and slowness, it is rarely used in end-user antivirus solutions.
* Data mining techniques: one of the latest approaches applied in malware detection. Data mining and machine learning
Machine learning (ML) is a field of inquiry devoted to understanding and building methods that 'learn', that is, methods that leverage data to improve performance on some set of tasks. It is seen as a part of artificial intelligence.
Machine ...
algorithms are used to try to classify the behaviour of a file (as either malicious or benign) given a series of file features, that are extracted from the file itself.
Signature-based detection
Traditional antivirus software relies heavily upon signatures to identify malware.
Substantially, when a malware sample arrives in the hands of an antivirus firm, it is analysed by malware researchers or by dynamic analysis systems. Then, once it is determined to be a malware, a proper signature of the file is extracted and added to the signatures database of the antivirus software.
Although the signature-based approach can effectively contain malware outbreaks, malware authors have tried to stay a step ahead of such software by writing " oligomorphic", " polymorphic" and, more recently, "metamorphic
Metamorphic rocks arise from the transformation of existing rock to new types of rock in a process called metamorphism. The original rock (protolith) is subjected to temperatures greater than and, often, elevated pressure of or more, causi ...
" viruses, which encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match virus signatures in the dictionary.
Heuristics
Many viruses start as a single infection and through either mutation
In biology, a mutation is an alteration in the nucleic acid sequence of the genome of an organism, virus, or extrachromosomal DNA. Viral genomes contain either DNA or RNA. Mutations result from errors during DNA replication, DNA or viral repl ...
or refinements by other attackers, can grow into dozens of slightly different strains, called variants. Generic detection refers to the detection and removal of multiple threats using a single virus definition.
For example, the Vundo
The Vundo Trojan (commonly known as Vundo, Virtumonde or Virtumondo, and sometimes referred to as MS Juan) is either a Trojan horse or a computer worm that is known to cause popups and advertising for rogue antispyware programs, and sporadical ...
trojan
Trojan or Trojans may refer to:
* Of or from the ancient city of Troy
* Trojan language, the language of the historical Trojans
Arts and entertainment Music
* ''Les Troyens'' ('The Trojans'), an opera by Berlioz, premiered part 1863, part 189 ...
has several family members, depending on the antivirus vendor's classification. Symantec classifies members of the Vundo family into two distinct categories, ''Trojan.Vundo'' and ''Trojan.Vundo.B''.
While it may be advantageous to identify a specific virus, it can be quicker to detect a virus family through a generic signature or through an inexact match to an existing signature. Virus researchers find common areas that all viruses in a family share uniquely and can thus create a single generic signature. These signatures often contain non-contiguous code, using wildcard character
In software, a wildcard character is a kind of placeholder represented by a single character, such as an asterisk (), which can be interpreted as a number of literal characters or an empty string. It is often used in file searches so the full na ...
s where differences lie. These wildcards allow the scanner to detect viruses even if they are padded with extra, meaningless code. A detection that uses this method is said to be "heuristic detection."
Rootkit detection
Anti-virus software can attempt to scan for rootkits. A rootkit
A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the exis ...
is a type of malware designed to gain administrative-level control over a computer system without being detected. Rootkits can change how the operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also i ...
functions and in some cases can tamper with the anti-virus program and render it ineffective. Rootkits are also difficult to remove, in some cases requiring a complete re-installation of the operating system.
Real-time protection
Real-time protection, on-access scanning, background guard, resident shield, autoprotect, and other synonyms refer to the automatic protection provided by most antivirus, anti-spyware, and other anti-malware programs. This monitors computer systems for suspicious activity such as computer viruses, spyware, adware, and other malicious objects. Real-time protection detects threats in opened files and scans apps in real-time as they are installed on the device. When inserting a CD, opening an email, or browsing the web, or when a file already on the computer is opened or executed.
Issues of concern
Unexpected renewal costs
Some commercial antivirus software end-user license agreement
An end-user license agreement or EULA () is a legal contract between a software supplier and a customer or end-user, generally made available to the customer via a retailer acting as an intermediary. A EULA specifies in detail the rights and rest ...
s include a clause that the subscription will be automatically renewed, and the purchaser's credit card automatically billed, at the renewal time without explicit approval. For example, McAfee
McAfee Corp. ( ), formerly known as McAfee Associates, Inc. from 1987 to 1997 and 2004 to 2014, Network Associates Inc. from 1997 to 2004, and Intel Security Group from 2014 to 2017, is an American global computer security software company head ...
requires users to unsubscribe at least 60 days before the expiration of the present subscription while BitDefender
Bitdefender is a Romanian cybersecurity technology company headquartered in Bucharest, Romania, with offices in the United States, Europe, Australia and the Middle East.
The company was founded in 2001 by the current CEO and main shareholder, ...
sends notifications to unsubscribe 30 days before the renewal. Norton AntiVirus
Norton AntiVirus is an anti-virus or anti-malware software product founded by Peter Norton, developed and distributed by Gen Digital since 1990 as part of its Norton family of computer security products. It uses signatures and heuristics to i ...
also renews subscriptions automatically by default.
Rogue security applications
Some apparent antivirus programs are actually malware masquerading as legitimate software, such as WinFixer
WinFixer was a family of scareware rogue security programs developed by Winsoftware which claimed to repair computer system problems on Microsoft Windows computers if a user purchased the full version of the software. The software was mainly in ...
, MS Antivirus, and Mac Defender
Mac Defender (also known as Mac Protector, Mac Security, Mac Guard, Mac Shield, and FakeMacDef) is an internet rogue security program that targets computers running macOS. The Mac security firm Intego discovered the fake antivirus software on 2 M ...
.
Problems caused by false positives
A "false positive" or "false alarm" is when antivirus software identifies a non-malicious file as malware. When this happens, it can cause serious problems. For example, if an antivirus program is configured to immediately delete or quarantine infected files, as is common on Microsoft Windows antivirus applications, a false positive in an essential file can render the Windows operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also i ...
or some applications unusable. Recovering from such damage to critical software infrastructure incurs technical support costs and businesses can be forced to close whilst remedial action is undertaken.
Examples of serious false-positives:
* May 2007: a faulty virus signature issued by Symantec mistakenly removed essential operating system files, leaving thousands of PCs unable to boot.
* May 2007: the executable file
In computing, executable code, an executable file, or an executable program, sometimes simply referred to as an executable or binary, causes a computer "to perform indicated tasks according to encoded instructions", as opposed to a data fil ...
required by Pegasus Mail
Pegasus Mail is a proprietary email client developed by David Harris (who also develops the Mercury Mail Transport System). It was originally released in 1990 for internal and external mail on NetWare networks with MS-DOS and later Apple Macint ...
on Windows was falsely detected by Norton AntiVirus
Norton AntiVirus is an anti-virus or anti-malware software product founded by Peter Norton, developed and distributed by Gen Digital since 1990 as part of its Norton family of computer security products. It uses signatures and heuristics to i ...
as being a Trojan and it was automatically removed, preventing Pegasus Mail from running. Norton AntiVirus had falsely identified three releases of Pegasus Mail as malware, and would delete the Pegasus Mail installer file when that happened. In response to this Pegasus Mail stated:
::
* April 2010: McAfee VirusScan detected svchost.exe, a normal Windows binary, as a virus on machines running Windows XP
Windows XP is a major release of Microsoft's Windows NT operating system. It was released to manufacturing on August 24, 2001, and later to retail on October 25, 2001. It is a direct upgrade to its predecessors, Windows 2000 for high-end and ...
with Service Pack 3, causing a reboot loop and loss of all network access.
* December 2010: a faulty update on the AVG anti-virus suite damaged 64-bit versions of Windows 7
Windows 7 is a major release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on July 22, 2009, and became generally available on October 22, 2009. It is the successor to Windows Vista, released nearly ...
, rendering it unable to boot, due to an endless boot loop created.
* October 2011: Microsoft Security Essentials
Microsoft Security Essentials (MSE) is an antivirus software (AV) product that provides protection against different types of malicious software, such as computer viruses, spyware, rootkits, and Trojan horses. Prior to version 4.5, MSE ran on , ...
(MSE) removed the Google Chrome web browser, rival to Microsoft's own Internet Explorer
Internet Explorer (formerly Microsoft Internet Explorer and Windows Internet Explorer, commonly abbreviated IE or MSIE) is a series of graphical web browsers developed by Microsoft which was used in the Windows line of operating systems ( ...
. MSE flagged Chrome as a Zbot banking trojan.
* September 2012: Sophos' anti-virus suite identified various update-mechanisms, including its own, as malware. If it was configured to automatically delete detected files, Sophos Antivirus could render itself unable to update, required manual intervention to fix the problem.
* September 2017: the Google Play Protect anti-virus started identifying Motorola
Motorola, Inc. () was an American multinational telecommunications company based in Schaumburg, Illinois, United States. After having lost $4.3 billion from 2007 to 2009, the company split into two independent public companies, Motorol ...
's Moto G4
Moto G4 is a line of Android smartphones manufactured by Motorola Mobility, a subsidiary of Lenovo. They are the successor to the third-generation Moto G, and were first released in Brazil and India on May 17, 2016, with the other markets follo ...
Bluetooth application as malware, causing Bluetooth functionality to become disabled.
* September 2022: Microsoft Defender flagged all Chromium based web browsers and Electron based apps like Whatsapp, Discord, Spotify as a severe threat.
System and interoperability related issues
Running (the real-time protection of) multiple antivirus programs concurrently can degrade performance and create conflicts. However, using a concept called multiscanning, several companies (including G Data Software
G Data CyberDefense AG (until September 2019 ''G Data Software AG'') is a German software company that focuses on computer security. The company was founded in 1985 and is headquartered in Bochum. They are known for being the creators o ...
and Microsoft
Microsoft Corporation is an American multinational technology corporation producing computer software, consumer electronics, personal computers, and related services headquartered at the Microsoft Redmond campus located in Redmond, Washin ...
) have created applications which can run multiple engines concurrently.
It is sometimes necessary to temporarily disable virus protection when installing major updates such as Windows Service Packs or updating graphics card drivers. Active antivirus protection may partially or completely prevent the installation of a major update. Anti-virus software can cause problems during the installation of an operating system upgrade, e.g. when upgrading to a newer version of Windows "in place"—without erasing the previous version of Windows. Microsoft recommends that anti-virus software be disabled to avoid conflicts with the upgrade installation process. Active anti-virus software can also interfere with a firmware update process.
The functionality of a few computer programs can be hampered by active anti-virus software. For example, TrueCrypt
TrueCrypt is a discontinued source-available freeware utility used for on-the-fly encryption (OTFE). It can create a virtual encrypted disk within a file, or encrypt a partition or the whole storage device ( pre-boot authentication).
On 28 M ...
, a disk encryption program, states on its troubleshooting page that anti-virus programs can conflict with TrueCrypt and cause it to malfunction or operate very slowly. Anti-virus software can impair the performance and stability of games running in the Steam platform.
Support issues also exist around antivirus application interoperability with common solutions like SSL VPN remote access and network access control
Network access control (NAC) is an approach to computer security that attempts to unify endpoint security technology (such as antivirus, host intrusion prevention, and vulnerability assessment), user or system authentication and network security ...
products. These technology solutions often have policy assessment applications that require an up-to-date antivirus to be installed and running. If the antivirus application is not recognized by the policy assessment, whether because the antivirus application has been updated or because it is not part of the policy assessment library, the user will be unable to connect.
Effectiveness
Studies in December 2007 showed that the effectiveness of antivirus software had decreased in the previous year, particularly against unknown or zero day attacks. The computer magazine ''c't
''c't'' – ' (''Magazine for Computer Technology'') is a German computer magazine, published by the Heinz Heise publishing house.
The 5.71 meter high tower from the 587 published c't editions up to the 30th anniversary has been in the foyer ...
'' found that detection rates for these threats had dropped from 40-50% in 2006 to 20–30% in 2007. At that time, the only exception was the NOD32
ESET NOD32 Antivirus, commonly known as NOD32, is an antivirus software package made by the Slovakia, Slovak company ESET. ESET NOD32 Antivirus is sold in two editions, Home Edition and Business Edition. The Business Edition packages add ESET R ...
antivirus, which managed a detection rate of 68%. According to the ''ZeuS tracker'' website the average detection rate for all variants of the well-known ZeuS
Zeus or , , ; grc, Δῐός, ''Diós'', label= genitive Boeotian Aeolic and Laconian grc-dor, Δεύς, Deús ; grc, Δέος, ''Déos'', label= genitive el, Δίας, ''Días'' () is the sky and thunder god in ancient Greek reli ...
trojan is as low as 40%.
The problem is magnified by the changing intent of virus authors. Some years ago it was obvious when a virus infection was present. At the time, viruses were written by amateurs and exhibited destructive behavior or pop-ups. Modern viruses are often written by professionals, financed by criminal organizations.
In 2008, Eva Chen
Eva Yi-Hwa Chen is a Taiwanese businessperson and the co-founder and CEO of Trend Micro, one of the world's largest software security firms. In 2010, '' CRN Magazine'' named her as one of the "Top 100 Most Influential Executives in the Industry ...
, CEO of Trend Micro
is an American-Japanese multinational cyber security software company with global headquarters in Tokyo, Japan and Irving, Texas, United State.Other regional headquarters and R&D centers are located around East Asia, Southeast Asia, Europe, and ...
, stated that the anti-virus industry has over-hyped how effective its products are—and so has been misleading customers—for years.
Independent testing on all the major virus scanners consistently shows that none provides 100% virus detection. The best ones provided as high as 99.9% detection for simulated real-world situations, while the lowest provided 91.1% in tests conducted in August 2013. Many virus scanners produce false positive results as well, identifying benign files as malware.
Although methods may differ, some notable independent quality testing agencies include AV-Comparatives
AV-Comparatives is an Austrian independent organization that tests and assesses antivirus software, regularly releasing charts and reports that are freely available to the public and the media. Antivirus vendors have to meet various requirements r ...
, ICSA Labs
ICSA Labs (International Computer Security Association) began as NCSA (National Computer Security Association). Its mission was to increase awareness of the need for computer security and to provide education about various security products and te ...
, West Coast Labs, Virus Bulletin
''Virus Bulletin'' is a magazine about the prevention, detection and removal of malware and spam. It regularly features analyses of the latest virus threats, articles exploring new developments in the fight against viruses, interviews with anti-vi ...
, AV-TEST
AV-TEST is an independent organization which evaluates and rates antivirus and security suite software for Microsoft Windows and Android operating systems, according to a variety of criteria. The organisation is based in Magdeburg, Germany.
Ever ...
and other members of the Anti-Malware Testing Standards Organization Anti-Malware Testing Standards Organization (AMTSO) is an international non-profit organization set up in 2008 to address a perceived need for improvement in the quality, relevance and objectivity of anti-malware testing methodologies.
Stated obje ...
.
New viruses
Anti-virus programs are not always effective against new viruses, even those that use non-signature-based methods that should detect new viruses. The reason for this is that the virus designers test their new viruses on the major anti-virus applications to make sure that they are not detected before releasing them into the wild.
Some new viruses, particularly ransomware, use polymorphic code
In computing, polymorphic code is code that uses a polymorphic engine to mutate while keeping the original algorithm intact - that is, the ''code'' changes itself every time it runs, but the ''function'' of the code (its semantics) will not chang ...
to avoid detection by virus scanners. Jerome Segura, a security analyst with ParetoLogic, explained:
A proof of concept
Proof of concept (POC or PoC), also known as proof of principle, is a realization of a certain method or idea in order to demonstrate its feasibility, or a demonstration in principle with the aim of verifying that some concept or theory has prac ...
virus has used the Graphics Processing Unit
A graphics processing unit (GPU) is a specialized electronic circuit designed to manipulate and alter memory to accelerate the creation of images in a frame buffer intended for output to a display device. GPUs are used in embedded systems, m ...
(GPU) to avoid detection from anti-virus software. The potential success of this involves bypassing the CPU in order to make it much harder for security researchers to analyse the inner workings of such malware.
Rootkits
Detecting rootkit
A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the exis ...
s is a major challenge for anti-virus programs. Rootkits have full administrative access to the computer and are invisible to users and hidden from the list of running processes in the task manager
In operating systems, a task manager is a system monitor program used to provide information about the processes and applications running on a computer, as well as the general status of the computer. Some implementations can also be used to t ...
. Rootkits can modify the inner workings of the operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also i ...
and tamper with antivirus programs.
Damaged files
If a file has been infected by a computer virus, anti-virus software will attempt to remove the virus code from the file during disinfection, but it is not always able to restore the file to its undamaged state. In such circumstances, damaged files can only be restored from existing backups or shadow copies (this is also true for ransomware); installed software that is damaged requires re-installation (however, see System File Checker).
Firmware infections
Any writeable firmware in the computer can be infected by malicious code. This is a major concern, as an infected BIOS could require the actual BIOS chip to be replaced to ensure the malicious code is completely removed. Anti-virus software is not effective at protecting firmware and the motherboard BIOS from infection. In 2014, security researchers discovered that USB
Universal Serial Bus (USB) is an industry standard that establishes specifications for cables, connectors and protocols for connection, communication and power supply (interfacing) between computers, peripherals and other computers. A broad ...
devices contain writeable firmware which can be modified with malicious code (dubbed "BadUSB
BadUSB is a computer security attack using USB devices that are programmed with malicious software. For example, USB flash drives can contain a programmable Intel 8051 microcontroller, which can be reprogrammed, turning a USB flash drive into a ...
"), which anti-virus software cannot detect or prevent. The malicious code can run undetected on the computer and could even infect the operating system prior to it booting up.
Performance and other drawbacks
Antivirus software has some drawbacks, first of which that it can impact a computer's performance.
Furthermore, inexperienced users can be lulled into a false sense of security when using the computer, considering their computers to be invulnerable, and may have problems understanding the prompts and decisions that antivirus software presents them with. An incorrect decision may lead to a security breach. If the antivirus software employs heuristic detection, it must be fine-tuned to minimize misidentifying harmless software as malicious (false positive
A false positive is an error in binary classification in which a test result incorrectly indicates the presence of a condition (such as a disease when the disease is not present), while a false negative is the opposite error, where the test resul ...
).
Antivirus software itself usually runs at the highly trusted kernel
Kernel may refer to:
Computing
* Kernel (operating system), the central component of most operating systems
* Kernel (image processing), a matrix used for image convolution
* Compute kernel, in GPGPU programming
* Kernel method, in machine learn ...
level of the operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also i ...
to allow it access to all the potential malicious process and files, creating a potential avenue of attack. The US National Security Agency
The National Security Agency (NSA) is a national-level intelligence agency of the United States Department of Defense, under the authority of the Director of National Intelligence (DNI). The NSA is responsible for global monitoring, collect ...
(NSA) and the UK Government Communications Headquarters
Government Communications Headquarters, commonly known as GCHQ, is an intelligence and security organisation responsible for providing signals intelligence (SIGINT) and information assurance (IA) to the government and armed forces of the Uni ...
(GCHQ) intelligence agencies,
respectively, have been exploiting anti-virus software to spy on users. Anti-virus software has highly privileged and trusted access to the underlying operating system, which makes it a much more appealing target for remote attacks. Additionally anti-virus software is "years behind security-conscious client-side applications like browsers or document readers. It means that Acrobat Reader, Microsoft Word or Google Chrome are harder to exploit than 90 percent of the anti-virus products out there", according to Joxean Koret, a researcher with Coseinc, a Singapore-based information security consultancy.
Alternative solutions
Antivirus software running on individual computers is the most common method employed of guarding against malware, but it is not the only solution. Other solutions can also be employed by users, including Unified Threat Management ( UTM), hardware and network firewalls, Cloud-based
Cloud computing is the on-demand availability of computer system resources, especially data storage (cloud storage) and computing power, without direct active management by the user. Large clouds often have functions distributed over mult ...
antivirus and online scanners.
Hardware and network firewall
Network firewalls prevent unknown programs and processes from accessing the system. However, they are not antivirus systems and make no attempt to identify or remove anything. They may protect against infection from outside the protected computer or network
Network, networking and networked may refer to:
Science and technology
* Network theory, the study of graphs as a representation of relations between discrete objects
* Network science, an academic field that studies complex networks
Mathematics ...
, and limit the activity of any malicious software which is present by blocking incoming or outgoing requests on certain TCP/IP
The Internet protocol suite, commonly known as TCP/IP, is a framework for organizing the set of communication protocols used in the Internet and similar computer networks according to functional criteria. The foundational protocols in the suit ...
ports. A firewall
Firewall may refer to:
* Firewall (computing), a technological barrier designed to prevent unauthorized or unwanted communications between computer networks or hosts
* Firewall (construction), a barrier inside a building, designed to limit the spr ...
is designed to deal with broader system threats that come from network connections into the system and is not an alternative to a virus protection system.
Cloud antivirus
Cloud antivirus is a technology that uses lightweight agent software on the protected computer, while offloading the majority of data analysis to the provider's infrastructure.
One approach to implementing cloud antivirus involves scanning suspicious files using multiple antivirus engines. This approach was proposed by an early implementation of the cloud antivirus concept called CloudAV. CloudAV was designed to send programs or documents to a network cloud where multiple antivirus and behavioral detection programs are used simultaneously in order to improve detection rates. Parallel scanning of files using potentially incompatible antivirus scanners is achieved by spawning a virtual machine per detection engine and therefore eliminating any possible issues. CloudAV can also perform "retrospective detection," whereby the cloud detection engine rescans all files in its file access history when a new threat is identified thus improving new threat detection speed. Finally, CloudAV is a solution for effective virus scanning on devices that lack the computing power to perform the scans themselves.
Some examples of cloud anti-virus products are Panda Cloud Antivirus and Immunet
Immunet is a free, cloud-based, community-driven antivirus application, using the ClamAV and its own engine. The software is complementary with existing antivirus software. In January 2011 Immunet was acquired by Sourcefire.
The application is f ...
. Comodo Group
Xcitium, formerly known as Comodo Security Solutions, Inc., is a cybersecurity company headquartered in Bloomfield, New Jersey in the United States.
History
The company was founded in 1998 in the United Kingdom by Melih Abdulhayoğlu. The com ...
has also produced cloud-based anti-virus.
Online scanning
Some antivirus vendors maintain websites with free online scanning capability of the entire computer, critical areas only, local disks, folders or files. Periodic online scanning is a good idea for those that run antivirus applications on their computers because those applications are frequently slow to catch threats. One of the first things that malicious software does in an attack is disable any existing antivirus software and sometimes the only way to know of an attack is by turning to an online resource that is not installed on the infected computer.
Specialized tools
Virus removal tools are available to help remove stubborn infections or certain types of infection. Examples include '' Avast Free Anti- Malware'', '' AVG Free Malware Removal Tools'', and ''Avira
Avira Operations GmbH is a German multinational computer security software company mainly known for their Avira Free Security antivirus software. Avira was founded in 2006, but the antivirus application has been under active development since ...
AntiVir Removal Tool''. It is also worth noting that sometimes antivirus software can produce a false positive result, indicating an infection where there is none.
A rescue disk that is bootable, such as a CD or USB storage device, can be used to run antivirus software outside of the installed operating system, in order to remove infections while they are dormant. A bootable antivirus disk can be useful when, for example, the installed operating system is no longer bootable or has malware that is resisting all attempts to be removed by the installed antivirus software. Examples of some of these bootable disks include the ''Bitdefender Rescue CD'', ''Kaspersky Rescue Disk 2018'', and ''Windows Defender Offline
Microsoft Defender Antivirus (formerly Windows Defender) is an antivirus software, anti-malware component of Microsoft Windows. It was first released as a downloadable free anti-spyware program for Windows XP and was shipped with Windows Vista a ...
'' (integrated into Windows 10
Windows 10 is a major release of Microsoft's Windows NT operating system. It is the direct successor to Windows 8.1, which was released nearly two years earlier. It was released to manufacturing on July 15, 2015, and later to retail on J ...
since the Anniversary Update
Windows 10 Anniversary Update (also known as version 1607 and codenamed "Redstone 1") is the second major update to Windows 10 and the first in a series of updates under the Redstone codenames. It carries the build number 10.0.14393. This update, ...
). Most of the Rescue CD software can also be installed onto a USB storage device, that is bootable on newer computers.
Usage and risks
According to an FBI survey, major businesses lose $12 million annually dealing with virus incidents. A survey by Symantec in 2009 found that a third of small to medium-sized business did not use antivirus protection at that time, whereas more than 80% of home users had some kind of antivirus installed. According to a sociological survey conducted by G Data Software
G Data CyberDefense AG (until September 2019 ''G Data Software AG'') is a German software company that focuses on computer security. The company was founded in 1985 and is headquartered in Bochum. They are known for being the creators o ...
in 2010 49% of women did not use any antivirus program at all.Nearly 50% Women Don’t Use Anti-virus Software
. Spamfighter.com (September 2, 2010). Retrieved on January 3, 2017.
See also
*
Anti-virus and anti-malware software
*
CARO
Caro may refer to: Places
* Caro, Michigan, United States
* Caro, Morbihan, France
* Çaro, Pyrénées-Atlantiques, France
Other uses
* Caro (given name), including a list of people with the given name
* Caro (surname), including a list of peo ...
, the Computer Antivirus Research Organization
*
Comparison of antivirus software
This article compares notable antivirus products and services. It is Wikipedia list article rather than a deep analysis of the strengths and weaknesses of each.
Legend
The term "on-demand scan" refers to the possibility of performing a manual ...
*
Comparison of computer viruses
The compilation of a unified list of computer viruses is made difficult because of naming. To aid the fight against computer viruses and other types of malicious software, many security advisory organizations and developers of anti-virus softwar ...
*
EICAR, the European Institute for Computer Antivirus Research
*
Firewall software
In computing, a firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted network and an untrusted n ...
*
Internet security
Internet security is a branch of computer security. It encompasses the Internet, browser security, web site security, and network security as it applies to other applications or operating systems as a whole. Its objective is to establish rules ...
*
Linux malware
Linux malware includes viruses, Trojans, worms and other types of malware that affect the Linux family of operating systems. Linux, Unix and other Unix-like computer operating systems are generally regarded as very well-protected against, but ...
*
Quarantine (computing)
*
Sandbox (computer security)
In computer security, a sandbox is a security mechanism for separating running programs, usually in an effort to mitigate system failures and/or software vulnerabilities from spreading. The isolation metaphor is taken from the idea of children w ...
*
Timeline of computer viruses and worms
A timeline is a display of a list of events in chronological order. It is typically a graphic design showing a long bar labelled with dates paralleling it, and usually contemporaneous events.
Timelines can use any suitable scale representi ...
*
Virus hoax
A computer virus hoax is a message warning the recipients of a non-existent computer virus threat. The message is usually a chain e-mail that tells the recipients to forward it to everyone they know, but it can also be in the form of a pop-up wind ...
Citations
General bibliography
*
{{DEFAULTSORT:Antivirus Software
Utility software types