Windows Vista Security: Praxisorientierte Sicherheit für Profis

518

|

Chapter 15: Protecting Your Computer with Windows Defender and Windows Firewall

the infected host computer, but they always replicate themselves to other comput-

ers. They act in very much the same way as a virus acts in the human body, which is

how they received their name. The good news is that since the popularity of the

Internet, many viruses have been permanently eradicated from the industry, due to

the capability to transfer code to eliminate the viruses from infected computers.

Introducing Antivirus Programs

The intent of an antivirus program is to identify, inoculate, disinfect, or clean a virus

or other malware program from a computer. Antivirus programs usually work in two

different ways. Most scan a computer in its entirety, looking for known viruses based

on their databases of virus listings, and then they delete, inoculate, remove, or quar-

antine the infected file. Other antivirus programs watch file behavior on the com-

puter. If the program detects unusual behavior, it will usually capture the file, scan it,

and then either ask the user for input on how to handle the issue or quarantine the

file for further inspection and possible deletion.

Most current commercial antivirus programs use both of these methods to detect

and eradicate viruses from infected computers. This helps eliminate the threat of

infection by watching the most consistent way viruses try to infiltrate computers.

The most common elements of virus removal involve repair of the file itself. This

consists of the antivirus program trying to remove the offending code from the

infected file. If the removal process does not work, the antivirus program usually will

quarantine the file discovered and prompt you for further instructions on how to

handle the problem with the infected file. When you log on to the computer after the

quarantine process, you must decide whether to try to repair the file again or delete

the infected file.

It should be noted that you should always attempt to use multiple antivirus pro-

grams to repair either files of a sensitive nature or those used by the operating sys-

tem before deleting the files. If you have a virus in a file you want to keep, you

should try to use multiple antivirus engines to repair the file. This also holds true for

operating system files. Operating system files infected with viruses may render the

infected computer incapable of operating correctly, sometimes to the point where the

infected computer will not boot into the operating system. Infections of this type

require a boot disk with an antivirus program to remove the virus from the com-

puter. McAfee Stinger is one example of this type of antivirus program.

Antivirus programs detect viruses via dictionary scans, behavior analysis, and other

methods. Each detection technique follows a specific type of logic in order to find,

repair, remove, or delete an infected file. Each approach is unique. Most antivirus

engines employ at least two of these types of analysis in order to identify viruses. The

third category is usually used only when specific types of viruses are encountered.

Each approach helps us to identify the methods virus writers employ to launch their

code so that we can begin the process of eradicating viruses from our environment.