Paul Kane
Updated on: December 20, 2023
In the never-ending cat and mouse game of virus vs antivirus, understanding how AV software identifies specific targets and prevents them from infecting your operating system can help better protect your computer from infiltration.
With hackers and other bad actors working ‘round the clock at spreading newer, deadlier viruses, essential to their malicious strategy is keeping them undetected for as long as possible.
Before we can deep-delve into the inner workings of an antivirus, let’s first look at how a computer virus spreads quickly across networks, undetected.
What Is a Virus and How Does It Work?
Viruses operate pretty much like any other program installed on your PC. The main difference, however, is the intent behind the program and exactly what the software has been programmed to do. Viruses are meant to harm, harvest, erase, eavesdrop, capture, or destroy important data on your PC or mobile device – sometimes all at the same time.
If you really want to understand computer viruses, it helps to know what to look for. Here are a few common symptoms related to viruses:
- Slower speeds on your computer
- Random error codes popping up
- Popups ads, warnings, and other unwanted material
- Browser pages redirecting to a website you’ve never interacted with
- Password locked out of important files or the system itself
- Delayed network speeds
Every virus contains a signature, which is like its fingerprint. It’s the distinguishing feature that sets it apart from other programs running on your computer, and it also makes the virus recognizable, and therefore a potential target for antivirus software.
Seeking out the viruses’ unique signature, antivirus software first scans for any signatures that contain similar patterns to what’s already stored in its existing database. New viruses are often derivatives of old ones, which means they might still share the same underlying DNA that’s easily identifiable. The database for each antivirus software contains definition files, and must constantly be updated to catch all new strains (or variations of the original virus’ DNA) that frequently pop up.
What Is Ransomware?
Ransomware attacks are a little blunter. They get into your device and lock it down. The only way to get your data back is to meet their demands, forking over anonymous payments so they can bounce around to the next host.
The worst part is that these hackers don’t just target large multinationals who can easily spare a few bucks, but even nonprofits that work to benefit the needy.
Little Red Door, out of Indiana, is one such example. Hackers were able to hold their member data hostage until Little Red Door forked over $43,000 to make this little inconvenience go away quietly.
There are so many virus permutations that manual protection is impossible. Worms, trojans, ransomware, keyloggers, adware, phishing, and many, many more, also don’t just prey on negligence. They’re clever and crafty.
Therefore, the best method of securing your PC and devices is prevention from the start, which is the main purpose of antivirus software.
The Rise of Antivirus Software
For almost as long as there have been computers, there have been viruses designed to infect them.
As far back as the 1970s, some of the earliest viruses began popping up. The very first one, most believe, was called The Creeper.
The Creeper was simply an experimental piece of software designed to spread from one computer to another across a crude network called ARPANET that eventually became a building block of the Internet.
The Creeper, in a sense, was the first computer worm.
To remove The Creeper virus, a computer engineer named Ray Tomlinson invented The Reaper — a computer worm whose sole job it was to find and delete The Creeper.
From these humble beginnings, computer viruses, worms, and malware began to grow in complexity by leaps and bounds.
So, too, did antivirus software; software designed to eliminate these threats.
Most modern antivirus software runs quietly in the background of your computer, completing repeated scans of your data, system files, and computer programs.
What are they looking for?
Antiviruses keep an eye out for:
- Known pieces of malware, which they reference against huge knowledge bases and dictionaries kept by their creators.
- Suspicious patterns or behavior; if it appears a non-human is manipulating your data or files, the antivirus will want to know why.
- Any incoming data, messages, or installations. Nothing should get through to your computer without a thorough inspection from the antivirus.
When an antivirus detects a threat, it will usually alert you and remove the malicious software.
How Antivirus Software Identifies and Prevents Malware
Cross-checking definition files in a database for known malicious software is one of the ways antivirus software works to defend your system. But that leaves an obvious, gaping hole: what about viruses so new or stealth they haven’t yet been identified and added to the database?
Anything not in the database, or anything that obscures the signature’s paper trail, can still slip through the cracks. Hackers aren’t dumb. They know how antivirus software works. They know how it will attempt to sniff out the right combo of 1’s and 0’s. So they will try to sidestep it.
One popular method is encryption – exactly what you’d normally use to protect yourself. But in this case, viruses will either encrypt themselves or parts of the signature so it can’t be matched successfully.
Encryptions lockdown sensitive data under an impenetrable lock. Depending on the encryption level used, it might be virtually impossible to break without the right cipher (or password) to decrypt the contents.
The result is successfully obfuscating a virus’ signature fingerprint to the point that your antivirus software has trouble even detecting it, let alone knowing how to stop it.
Another trick includes mutation like a biological virus. Here, the malware will infect a device and then spin off spawns of all shapes and sizes. So now you’re not just fighting one battle, but an all-out war on several fronts at the same time – each with a different type of malware and required antidote.
Antivirus tools, in response, counterpunch with a few tricks of their own.
The first is through heuristic detection or analysis. Instead of trying to detect just a single signature and fall victim to a mutation, antivirus software will combine related ones into ‘families.’ That way, they can use a broader generic signature to identify anything that looks or smells or acts like a virus from each family. That’s not the only trick up their sleeve, though.
A rootkit is malware that specifically targets administrative controls on a device. Just like it sounds, these aim for complete control over the entire operating system, embedding itself at the metaphorical ‘roots’ so you can’t get rid of it.
Rootkit detection is used to check and see which actions a program is attempting to execute, and based on those actions, determine whether it’s malicious (and how to stop it accordingly).
One similar technique is through using a sandbox before installing any new software. Think about this website you’re reading. It has a ton of visitors, so we wouldn’t want to push a new feature live without testing it first. Install an untested plugin, for instance, and you risk a bug bringing down the entire website.
Instead, you’d test any new features on a staging server, first. It’s like a working replica that allows you to make changes and analyze the impact before pushing it ‘live.’
The same idea applies to a sandbox used by antivirus software. In this case, it will test a new file or run a new piece of software and then sit back and wait. It’ll watch what happens, and what the program tries to do. But all of this occurs in a safe, isolated environment. And it’s only when everything checks out that the program will actually be allowed to run on your device.
Sandboxing is considered a behavioral-based detection scheme because it’s judging the behavior of the virus, as opposed to automatically classifying it based on its properties.
Last but not least, antivirus software is beginning to layer on machine learning to these behavior-based techniques. That way, they can predict what’s about to happen (based on previous similar actions) and stop it in its tracks before it does.
If you’re following along at home, you’ll notice the key to antivirus software success isn’t through one tactic. Viruses are too nimble and sophisticated, able to shapeshift at a moment’s notice to easily bypass one or two security checkpoints. Instead, antiviruses combine a few different strategies with different methods of detection to stop as many attacks as possible.
Features of Modern Antiviruses
Times have changed significantly since the earliest days of basic computer worms and self-replicating viruses.
While malware has evolved and remains a threat, cybercriminals have plenty of other avenues through which they conduct attacks.
The very best antiviruses will offer much more comprehensive protection than just simple virus scans.
System Scans
Any antivirus worth its salt will be able to scan your system for threats.
Extremely basic, and often free, versions will sometimes only run a scan when prompted by the users, while higher end builds will run regular or even real-time scans.
Malware Removal
Once malware has been found, an antivirus won’t do you much good if it can’t also remove the threat!
Not all virus elimination is created equal, however, with higher-end antiviruses usually outscoring competitors in independent lab tests that measure a number of factors including thoroughness of scans and removal.
Ransomware Protection
Ransomware is a particularly nasty form of malware that gathers your most important data and locks it away behind complex encryption.
In order to receive the key to unlock your files, you’re asked to pay the attacks a ransom; usually several hundred dollars.
While most antiviruses will be able to remove ransomware, that won’t get you your files back! The best ones will offer proactive protection and delete the malware before it impacts your files, or offer you a secure place to store your most important data where criminals can’t touch it.
Phishing Protection
Phishing and social engineering are more advanced identity theft tactics that work by manipulating you into willingly handing over passwords, banking information, and more.
Top-notch antiviruses will recognize phishing attempts and alert you before you make the crucial mistake of sharing your information with the wrong person.
WiFi Inspection
How often do you join a public WiFi network on your phone or laptop without giving it a second thought?
The frightening truth is that it’s easy for hackers to set up fake networks and steal your personal information when you join.
A really good antivirus will be able to scan a public WiFi network for vulnerabilities and suspicious behavior before you connect and compromise your device.
Multi-Device Protection
These days, our phones are more powerful than full-sized computers were a decade ago.
We use them to browse the Internet, message friends, share photos, download media, and more.
If your antivirus doesn’t offer any protection for your Apple or Android device, you’re leaving yourself extremely vulnerable.
And that’s just a taste of what advanced antivirus software can do. As cybercrime grows and learns to exploit new channels, the top names in antivirus protection continue to add features to their products.
3 Reasons You Need an Antivirus
Antivirus software is a lot like insurance.
You hope you never need it, but if you’re ever caught in a crisis without it, you’ll seriously regret not planning ahead.
Pretty much everyone — PC, Mac, and mobile users included — should use some kind of antivirus on their devices.
Here’s why:
Malware Is More Malicious Than Ever
Remember The Creeper virus, the first computer worm ever?
All it did was hop from computer to computer reading out a cute little message.
Long gone are the days where malware was a nuisance that locked up your computer until you could remove it.
Now, just one malware attack could leak your personal information onto the black market, steal all of the cash from your bank account, or delete every important file you own.
Why chance it?
Browsers and Operating Sytems Are More Secure Than Ever, But Far From Perfect
Mac computers get attacked far less frequently than Windows machines do. And Windows has substantially beefed up its security in recent years.
On top of that, the most popular web browsers are better than ever at detecting and avoiding threats while you surf the Internet.
However, new exploits and vulnerabilities are found every single day.
Remember, it only takes one attack for you to potentially lose every file on your computer or have your entire identity stolen.
Hackers are working overtime to try to break through your operating system’s defenses. You’re far better off to have more protection in place.
Mobile Is Still the Wild West
Unless your phone is brand new, there’s a decent chance you’re running an out-of-date version of its operating system.
For phones that are a few years old, they might not even be able to update to the latest version.
That leaves millions of people with, likely, severe security vulnerabilities on their phone that they can’t fix.
In addition, more and more people are choosing free apps from unreliable sources, which can be dangerous. It’s also challenging to ensure the safety of links on the Internet, especially on mobile devices, which can inadvertently lead you to harmful websites and malware.
Safe browsing behavior will go a long way, but you’ll be much better off with an antivirus that secures all of your devices.
Antivirus technology has come a long way, and it’s had to. The frantic pace of malware evolution has lead to some truly amazing innovations in cyber-protection.
Today’s cybercriminals are just too vicious — it’s definitely worth exploring antivirus software further and learning about how it can protect you.
