So I was thinking about viruses recently, and wondering how exactly antiviruses keep up? Considering anybody who'd been coding for a few weeks could hack together something do do nasty, nasty things to somebody's PC, the quantity alone would make a simple list of hashes prohibitive, so how do antiviruses do it? Do they monitor process activity and have a 3 strikes rule for doing virus-like things? And if so, what's stopping it from triggering on perfectly harmless things (like me moving files around in \system32)?

I did a bit of googling, but the regular places didn't particularly help, and I couldn't find a dupe here, so I thought it'd be good to ask :)

  • 4
    @joe there's no need to add a windows tag. An antivirus works pretty much the same way in any OS. Also, the way an AV works is not subjective. – alex Oct 20 '09 at 10:19
  • oh. Sorry I was thinking this may be on windows and subjective . I understand that – joe Oct 20 '09 at 10:20
  • 6
    They come preinstalled when you buy a laptop and keep moaning for 60 days that you should register/pay for them, until you finally get them out of your system. Usually, their dialogs are modal and topmost so that they can effectively block you from doing anything else, and they never offer an easy way to uninstall. – Daniel Daranas Oct 20 '09 at 10:22
  • bump the +1 for a very nice question – dag729 Mar 5 '10 at 20:35
  • AV heuristics are sophisticated but will fail to detect new threats (or clever variants of existing threats). Heuristics often produce false positives on completely benign software/code. AV software is useful but is often a crutch, giving users a false sense of security. I've tested many known viruses on (virustotal.com/en) and top names like Symantec, McAfee and AVG detect nothing (though Kaspersky generally does well). Better is to know your system, watch what you do...and have a backup! – AlainD Apr 29 '16 at 9:17

This article from 2002 talks about building an antivirus engine.

The article will describe the basic ideas, concepts, components and approaches involved in developing an anti-virus program from scratch from a developer’s/software engineer’s point of view. It will focus on the main elements of an anti-virus engine (hereafter referred to as AV engine) and will exclude aspects like graphical user interfaces, real-time monitors, file system drivers and plug-ins for certain application software like Microsoft Exchange or Microsoft Office. Although AV engines running/scanning for single platforms (such as Palm OS or EPOC/Symbian OS) can be designed in the same way, this article will focus on designing multi-platform scanning engines, which are far more complex.

There's also an article on heuristic techniques to detect infections. It's also an interesting read.

  • +1 for that heuristics article - very interesting :) – Phoshi Oct 20 '09 at 9:57
  • That's the one that really is worth the read. The heuristics part is essential :) – alex Oct 20 '09 at 9:59
  • I have a new-found respect for antiviruses after reading that, pretty clever stuff! – Phoshi Oct 20 '09 at 10:00
  • They're incredibly complex applications. Unfortunately, they have been turned them into something that a lot of people, including myself, detest. Custom, sloppy, unintuitive interfaces, features tacked on just to add another bullet point to the feature list, bloat. This is stuff that has turned them into nightmares. Things are turning around, though; the finest example of a good AV solution is MSE. – alex Oct 20 '09 at 10:05
  • It was the heuristics stuff that tipped it, sorry joe :P Good answer regardless :) @alex; Alas, I have to agree, but understanding the complexities below makes me sympathise more. It's complex stuff, and wouldn't make enough sense to intice a potential customer, wheras "Customisable colour GUI!" might :( – Phoshi Oct 20 '09 at 10:19

About a year ago I attended a lecture by Mikko Hyyppönen, one of F-Secure's main researchers. He showed their automated testing network, where they create virtual machines for every sample sent to them, analyze it's structure, let it run, log everything it does, cross-reference it with previous samples and generate a summary for a human to check later. If the human concludes that it's a virus, the system automatically generates the detection signature and sends an update to the customers. I imagine other vendors have similar systems as well to keep their signature databases up to date.


From How does anti-virus software work? (AntivirusWorld):

An anti-virus software program is a computer program that can be used to scan files to identify and eliminate computer viruses and other malicious software (malware).

Anti-virus software typically uses two different techniques to accomplish this:

  • Examining files to look for known viruses by means of a virus dictionary Identifying suspicious behavior from any computer program which might indicate infection
  • Most commercial anti-virus software uses both of these approaches, with an emphasis on the virus dictionary approach.

Virus dictionary approach In the virus dictionary approach, when the anti-virus software examines a file, it refers to a dictionary of known viruses that have been identified by the author of the anti-virus software. If a piece of code in the file matches any virus identified in the dictionary, then the anti-virus software can then either delete the file, quarantine it so that the file is inaccessible to other programs and its virus is unable to spread, or attempt to repair the file by removing the virus itself from the file.

To be successful in the medium and long term, the virus dictionary approach requires periodic online downloads of updated virus dictionary entries. As new viruses are identified "in the wild", civically minded and technically inclined users can send their infected files to the authors of anti-virus software, who then include information about the new viruses in their dictionaries.

Dictionary-based anti-virus software typically examines files when the computer's operating system creates, opens, and closes them; and when the files are e-mailed. In this way, a known virus can be detected immediately upon receipt. The software can also typically be scheduled to examine all files on the user's hard disk on a regular basis.

Although the dictionary approach is considered effective, virus authors have tried to stay a step ahead of such software by writing "polymorphic viruses", which encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match the virus's signature in the dictionary.

Suspicious behavior approach The suspicious behavior approach, by contrast, doesn't attempt to identify known viruses, but instead monitors the behavior of all programs. If one program tries to write data to an executable program, for example, this is flagged as suspicious behavior and the user is alerted to this, and asked what to do.

Unlike the dictionary approach, the suspicious behavior approach therefore provides protection against brand-new viruses that do not yet exist in any virus dictionaries. However, it also sounds a large number of false positives, and users probably become desensitized to all the warnings. If the user clicks "Accept" on every such warning, then the anti-virus software is obviously useless to that user. This problem has especially been made worse over the past 7 years, since many more non malicious program designs chose to modify other .exes without regards to this false positive issue. Thus, most modern anti virus software uses this technique less and less.

Other ways to detect viruses Some anti virus-software will try to emulate the beginning of the code of each new executable that is being executed before transferring control to the executable. If the program seems to be using self-modifying code or otherwise appears as a virus (it immediately tries to find other executables), one could assume that the executable has been infected with a virus. However, this method results in a lot of false positives.

Yet another detection method is using a sandbox. A sandbox emulates the operating system and runs the executable in this simulation. After the program has terminated, the sandbox is analyses for changes which might indicate a virus. Because of performance issues this type of detection is normally only performed during on-demand scans.

Issues of concern

Macro viruses, arguably the most destructive and widespread computer viruses, could be prevented far more inexpensively and effectively, and without the need of all users to buy anti-virus software, if Microsoft would fix security flaws in Microsoft Outlook and Microsoft Office related to the execution of downloaded code and to the ability of document macros to spread and wreak havoc.

User education is as important as anti-virus software; simply training users in safe computing practices, such as not downloading and executing unknown programs from the Internet, would slow the spread of viruses, without the need of anti-virus software.

Computer users should not always run with administrator access to their own machine. If they would simply run in user mode then some types of viruses would not be able to spread.

The dictionary approach to detecting viruses is often insufficient due to the continual creation of new viruses, yet the suspicious behavior approach is ineffective due to the false positive problem; hence, the current understanding of anti-virus software will never conquer computer viruses.

There are various methods of encrypting and packing malicious software which will make even well-known viruses undetectable to anti-virus software. Detecting these "camouflaged" viruses requires a powerful unpacking engine, which can decrypt the files before examining them. Unfortunately, many popular anti-virus programs do not have this and thus are often unable to detect encrypted viruses.

Companies that sell anti-virus software seem to have a financial incentive for viruses to be written and to spread, and for the public to panic over the threat.

(I like this article, and I just copy and pasted from AntivirusWorld.)

  • Thanks :) For the dictionary approach, does that mean if I copied a known virus' code and put it in my application, it'd be detected, but if I wrote something similar it'd have to wait for the suspicious behaviour thing? (Hypothetically, of course) – Phoshi Oct 20 '09 at 9:52
  • YES.. it will be . – joe Oct 20 '09 at 9:52
  • That makes sense, if you can't stop viruses being made, then stopping the existing code is pretty good (and given an infinite amount of time, would stop every possible virus - not bad :P) – Phoshi Oct 20 '09 at 9:58
  • That's what a signature is. A portion of malicious machine code that's common to more than one virus. – alex Oct 20 '09 at 10:06
  • If the AV compares a file to a dictionary of, say 10,000 known viruses, then why is it that FAST? How come each file takes milliseconds to scan.. – LantisGaius Oct 20 '09 at 13:21

Phoshi, your question is very interesting, but I suggest you to start your quest with another one. I'm advicing this because the answers to the question you have asked can mislead you.

I suggest you to start with thinking about what do you consider a virus, what's its definition.

Elite virus writers are security researchers, not script kiddies. Their virus definition is: "a virus is a piece of code that can multiply itself". That's it. As you can see, there are no destructive features mentioned here. All viruses mandatory being evil - that's FUD you get from proprietary antivirus makers so they could sell their software.

IMHO it's wise to treat viruses as a part of the whole software ecosystem, not as outside evil "aliens".

  • Well, I did ask how AVs work, so I think the answers... answer that quite well, but you make a very good point, It's something to think about :) – Phoshi Oct 20 '09 at 15:38
  • Watching two antiviruses on the same computer trying to kill eachother is also hilarious. Feel free to wonder why they do that :-) – geek Oct 20 '09 at 17:45

One very important way to look at virusses is the other way around. How do Viruses compromise systems. This is usually through software vulnerabilities. Anti virus software is aware of these vulnerabilities and looks for software influencing these vulnerabilities. Either way, virusses always DO someting. So they need a working process to do whatever they do best. Sometimes this is in an existing one, sometimes they create one themselfs.

However, MOST viruses work in similar ways, making it easy for a virus-scanner to distinguish between them. There are many different viruses making use of the same vulnerability!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.