In this lesson we'll see how an antivirus software detects whether the file has the virus present in
it.
So in short going to discuss about the detection techniques.
The first one is the signature based detection it is the most common method to identify viruses and
other malware is antivirus software compares the contents of a file to dictionary of virus signatures
because viruses can embed themselves in existing files.
The entire file is searched not just as a whole but also in pieces.
So basically signature detection technique is just comparing the contents are fine.
And if you find that virus in the study as well as in the file then you declare it has a virus has some
malicious activity detection is.
Which is which is also known as another way to identify malware.
In this approach antivirus software monitors the system for suspicious behavior program and the last
one is a huge mistake.
This detection like malicious activity detection realistically can be used to identify unknown viruses.
So let us explore each of these matters in detail.
So signature this reduction is the most common method the cannula software is or use this to identify
malware.
This method is somewhat limited by the fact that it can only identify a limited amount of emerging threats
that is generic or extremely broad.
Signatures then antivirus software scans a file for viruses.
It checks the contents of file gainst or dictionary of the signatures a virus signature is the viral
code.
Finding a virus signature in a file is the same as saying you found the virus itself.
If a virus signature is found in a file the antivirus software can pick action to remove the virus and
to add a software will usually perform one or more of the following actions.
Quarantining repenting or deleting quarantining of fine will make it inaccessible and is usually the
first action antivirus software move big IT FOR shift finest fun and crippling the fine is a good quarantine
technique because it trained those to find useless.
Sometimes a user wants to see the content of an infected file because viruses can sometimes embed themselves
in the files called code injection and the file may be essential to normal operation.
To do this antivirus software will attempt to pay the fine to do this.
The software will try to remove the viral cause from the file.
Unfortunately some viruses might damage it to file upon injection the Tor action antivirus software
can take against a virus is straight away.
Deleting the fight if a final repair operation fails usually the best thing to do is just to delete
the file deleting the file is necessary if the entire point is infected and you may also lose the contents
of the fight.
Because New viruses are being created each day the signature based redaction approach requires frequent
updates of the virus signature dictionary to assist.
These are my antivirus software companies.
The software may allow users to upload new artists or videos to the company signature based antivirus
software typically examines files in the computer's operating system creates opens closes or e-mails
them.
In this way it can detect a known virus immediately upon the receipt system administrators can schedule
antivirus software to scan all the files on the computer hard disk Act a set time and date.
Although the signature based detection approach can effectively contain virus outbreaks in the right
circumstances virus authors have tried to stay deep ahead of software by writing or legal more thick
volume of thick and dirty simply metamorphic mitosis which encrypts parts of themselves or otherwise
modify themselves at a method of disguise so as not to match the wider signatures in the dictionary.
So the main disadvantage of signature bill detection is that you constantly need to update your database
and since the virus makers are pretty intelligent they find some of the other way to escalate this signature
based detection so the next type of detection technique is suspicious behavior of monitoring suspicious
behavior.
Approach by contrast does not attempt to identify known viruses but instead monitors the behavior of
all the programs.
If one program tries to write data to an exit executable program for example if the antivirus software
can flag this suspicious behavior then it can other to use it and ask the user what actions are needed
to be done.
Taken a life cystic nature based approach this suspicious behavior approach and therefore provides protection
against brand new viruses that do not yet exist in any letters dictionaries.
However it can also sound a large number of false positives and you know use them and become desensitized
to the warnings.
If a user clicks accept on every such warning then the antivirus software obviously gives no benefit
to that user.
This problem has worsened since 1997 since many more no malicious programs designed to came to modify.
Other doctors actually failed without regard to this false positive issues.
In recent years however sophisticated behavior analysis has emerged which analyzes process and calls
the cardinal in context before making a decision which gives it a low false positive rate than rules
based on behavior monitoring and the last one is your mistakes some of or more sophisticated antivirus
softwares using the holistic based approach to identify new maladies.
So in this way you hear two methods are used for analysis and finding mutation as described above or
in previous lecture or file analysis is the process by which antivirus software will analyze the instructions
of a program based on the instructions the software can determine whether or not the program is malicious.
For example the file contains instructions to delete important system files.
The file might be flagged as a virus.
While this method is useful for identifying new viruses and variants it can trigger many false alarms.
The second egotistic approach is find a mutation by this but the target file is run in a virtual machine
environment separate from the real system environment.
The antivirus software would then log what actions the file takes in the water environment.
The actions are found to be damaging.
The file will be marked as a virus but again this method can also trigger false alarms because you know
it solely depends upon them to develop or what hour to decide how to decide whether it is a virus or
not.
So these are the methods in which antivirus detection techniques work or antivirus removal tool or what
are generally antivirus consist of a virus removal tool which is a software for removing specific viruses
from infected computers.
Unlike complete antivirus scandals that which really not intended to detect and remove an extensive
list of viruses rather they are designed to remove specific viruses usually which are more effective
than not one antivirus softness.
So in the next lesson we will see.
Okay we'll see in this lecture on lethal.
These are the types of famous antivirus companies since the beginning of Gaskell skylights.
I'll ask the antivirus Trend Micro antivirus and McAfee and antivirus To be honest with you.
There are dozens of companies available in the market who are currently setting down diverse products
but I would suggest that do not fall into pre of free antivirus software.
As there are no such software which totally prevent your system it is always better to pay to get your
data saved securely because you know once your data is lost it cannot.
It is very difficult to get your data back.
So I would always suggest you to pay for some thought first and that is no such thing that this is which
is the best software.
Every company every software has its own distinctive features.
So I recommend you to look properly before buying any software but do not fall prey to the free software
that are available over the Internet.
As these files can itself be a virus so stay alert and look.
You know now we have understood what is antivirus software.
You can surely look into D.T..