I found this question which expalins a little in detail of how Anti-Virus softwares work exactly. But I just had a client ask me this, and I really couldn't give him a good, simple, easy to understand answer. Best thing I could come up with was that each virus has a specific "fingerprint" and the software scans in known infected areas for them.
How do I explain this in a simple easy to understand fashion?
Detection mechanism, or how they on a deeper level?
When people say to me about how did malware get on their machine, and why is it not always possible to remove once it is on the system, and pretty much anything to do with malware I always answer with a combination/similar to this metaphor:
(And when I write it down, I must sound a bit like an idiot, but I hope you like it!)
Imagine your house is the computer, an anti virus program is several different security mechanisms.
Imagine a bouncer on your front door - anyone coming in to the house (files coming in to your machine) go through him and he checks that they are clean*. If he finds something bad, he usually gives you the option of what to do.
Imagine an internal security team watching everyone (active processes) in your house, any object (file) that they touch gets looked at to make sure they are clean*
When there is nothing else to do, or you choose, you can have the security team check every object in the house, just to make sure they are clean against the latest threats.
Whilst your home security will always do its best, nothing is 100% effective. Once someone is in the house, if they were not stopped, they can do whatever they want. Whilst it is possible to clean up after them, and in most cases, undo all the damage... they could of left their own security team behind that interferes with your own.
`* As Randolph said in his answer typically it is a mix of fingerprint and Heuristics)
I can't seem to find it, but Microsoft used to have an API document about creating AV software, I can only find a link to the MS Office/IE API guide. I am guessing that due to fake AV/Root kits, they have removed this information.
(Also, Symantec have an interesting article for further reading)
Edit - Just found an intersting Stack Overflow Question... How does a Windows antivirus hook into the file access process?
They operate on several levels, including:
The fingerprint definition, as you stated, which checks for activity or file signatures that match a database
Suspicious behaviour, for example, the boot sector is modified by something that isn't recognised, or memory is overwritten by a process that shouldn't have access
Rootkit detection, which requires the AV to run almost as a virus itself (* this is why AVG does not like ComboFix, for instance - it does things that are indistinguishable from virus behaviour), in that it has to hide itself from the rootkit.
This is certainly not a complete list, and I welcome edits to the answer.
I've several times been in a position of telling people they need AV software while fending off volunteered "expert" criticism that AV software is "worthless" because new, unfingerprinted viruses would not be stopped and as Wil says, they can leave stuff behind that makes true cleanup impossible.
I think it is important that non-super users understand those last two points but not think that AV software is worthless. They also need to understand a third point, that a careful backup plan is required with an eye towards "Nuke it from orbit, its the only way to be sure" cleanup where the system is wiped and the OS is reinstalled from known good backups.
Your operating system is a building and the virus is a thief
Windows is an Office building
While everybody is allowed to go in and out, they have to pass through security where their bags are checked and they walk through an x-ray. This would be the equivalent of an active scanner. Everything is checked so there's a small chance that anything will get taken through the front door.
Throughout the facility there are cameras and security guards monitoring them to look for suspicious activity. This is the Passive Scan. The security guards are pretty good at pinpointing common mischievous behavior because they spend all day every day watching people.
The kicker is, if the you do the funky chicken dance through the x-ray scanner you'll get through, no questions asked.
An infection goes like this. The thief does the funky chicken dance past the guard at the front. Once they're in and take what they want, they just need to find (or create) a back door to get out with the goods.
If the thieves are unsophisticated, the passive scanners will raise an alarm and send security after them but, if you've watched Oceans Eleven lately, you'll know what I mean when I say, "not all thieves are unsophisticated". Essentially, once a bad guy gets inside, if he's good he'll know how to evade and subvert your the surveillance system so you don't even know he's there. Then it's free game with your data.
Even worse, they're influential. They make friends inside your system (infect other applications) so, even if you're successful in giving them the boot, they can just call up a buddy to let them back in. Passive scanners don't just watch for bad guys, they watch everybody's behavior but they're not perfect.
A Trojan is like a hidden thief hiding out by one of the emergency exits, if he hears a secret knock from one of his buddies outside, he opens the door from inside. You really don't want one of these in your building because they're extremely talented.
A Mac is an Office Building but with a keycard system
Once you enter the building, you have to sign in with the guard to get your pass. But, once you're in you have freedom to move about the areas where you have permission to roam. If you need to get access to the company inventory you need to sign in again for a higher level pass to continue. Every time you leave a level of security, you lose your pass so you have to sign for it each time you need to get back in.
The vulnerability here is, make sure you know that the person you're giving access is supposed to be allowed in.
Linux is like a military base
You have to pass security to get in the gate but you also need rank/title to gain access to parts of the base. For instance, you can't get into the air field if you're not a pilot (and aren't a superior officer), you can't get into the submarine if you're not a sub guy.
Think of the root account as the General. He doesn't need permission to go anywhere because he is the most superior officer on base. Therefore, you don't want to let your general go around letting just anybody into the base (because he'll be obeyed without question).
The trick with Linux is, don't make yourself the General. Make yourself a petty officer who dutifully does his job. Then, when that petty officer discovers he needs some additional resources to get his job done, upgrade him temporarily (the command for elevated privileges in linux is sudo which grants temporary root access) to General to get things moving and shaking.
In reality Linux and Unix use the same security model for privileges. Macs just don't compartmentalize the system like Linux does to make it more user friendly.
The major problem with all of these systems is, once the thieves find a way in, they can create a back door to get back in later without having to go through security.
The only really safe system security wise would be to have a more sophisticated system. Like, go back in time to the beginning of the day at the end of each day. This is the equivalent to sandbox virtualization. Every time you load the OS, it loads a fresh, unadultered copy. No backdoors will exist because the OS will be set back to the state it was in before the thieves ever got in. There are limitations to this method but they're too detailed/complex to cover here.
The trick that most people (some conveniently) overlook is. Once you let somebody into the building and give them access privileges, they can let others in. So, don't let the guy wearing the black and white striped shirt (and, in some cases the little girl with the quantum mechanics book) in the front door in the first place. With the exception of the funky chicken dance, they can't get in unless you let them.
The issue with virus scanners is, people rely on them too much. Consider that neither your active or passive scanners know about the funky chicken trick. You've just freely let a bad guy into your system. If your fortunate, he'll do something that raises the attention of the passive scanner. If your not fortunate, he'll move from shadow to shadow within your system wreaking havoc and you won't even know that he's there.
0-day software vulnerabilities (known software defects exposing a security hole that hasn't been patched yet) are the equivalent to the funky chicken dance. Microsoft isn't the only party to blame for these either; I've seen an Adobe Flash hack get through and trash my system beyond repair in <15 seconds.
Windows/Linux tend not to have the funky chicken problem because you carry your access privileges (keycard, rank) everywhere you go throughout the system.
A rootkit is like having one of these guys kidnap your executive security officer, lock him in the closet, and impersonate him. With the rank as the head of security, he has the power to hire/fire anybody and change policy at his whim. If they get to him you're really screwed because he can lay off the whole security staff or implement policies that force the security staff to stare at their feet and sit on their hands on the threat of being fired. Ie. you really don't want this guy to be compromised.
I hope that helps.
