Sunday, August 23, 2009

How does a computer become "infected" with a virus?

and how does security software prevent it?



How does a computer become "infected" with a virus?virus scan



There are many different types of viruses, but in the most classic and general sense, a virus is a short section of code that is introduced into a host program (executable file). When a file infected with a virus is run, the virus code is run as well. Usually, the virus code, when run, will attempt to modify other executable files by inserting a copy of its code into them. This is how a virus propogates.



Various Anti-Virus software packages use combinations of many different techniques. The most common method of finding viruses is by scanning files for strings of code that are found in viruses. Each virus has a 'virus definition', which includes a string of code you'd find in the virus. Whe A-V software scans files, it compares each file's contents to each 'virus definition'. If a match is made, the software assumes it's found a virus and identifies it as such.



AV software can also find viruses based on behavior. For instance - viruses tend to behave in certain ways... in order to duplicate, they have to modify executable files. An AV program could 'keep watch' for any process overwriting executable files, or doing anything else that might appear suspicious. The limits to this type of scan are limitless.

No comments:

Post a Comment