Got Antivirus? If you have a computer, the answer is probably yes. Viruses are growing exponentially, so the manufacturers have to be on their toes if they want to keep systems protected. It used to be as simple as analyzing your email and hard drive to look for viruses – not anymore!Lets take a look under the hood of your AV solution.

Primary Components of Antivirus

The heart of your antivirus solution is the DAT file – the key component that contains all the latest information your manufacturer has about known threats. Each data entry provides a fingerprint – a way of describing what a virus is and what to look for. After taking an initial scan of your system, the antivirus product will keep a constant watch on the file system (usually by asking the OS if any file additions or deletions have occurred), comparing new changes to the hard rive to the DAT file.

Email and Antivirus

There are two components to the email antivirus solution. First, we need to keep the mail server itself protected. This is done in the same way as a traditional server, by comparing the changes to the file system against the DAT file. We also need to analyze the data stream of emails – particularly looking at the attachments and embedded code inside of an email to check for possible malicious threats. This can be particularly difficult, as virus writes get more sophisticated in changing the “fingerprint” of their virus as it infects new systems.

What happens when a new virus breaks out?

Using virus definitions is great for known viruses. New viruses are coming out all the time, and the fact is that definitions while a good tool cannot help you when you system is getting bombarded with new threats. Enter Heuristic scanning. Heuristic is a type of generic scanning that looks at the actual code in the data stream and attempts to make intelligent decisions about the structure of that code. For instance, if a file is a video or audio file, but is also doing file I/O on your hard rive, then something may not be accurate. The antivirus solution is trying to make decisions based on what a piece of code should do. Of course, this is not perfect, and many times may cause problems with other programs. if you are installing new software and it is not working, antivirus is often the first place to look.

We will talk more about antivirus in the future, and what other add ons you should consider to your antivirus tool.