Scribd Logo
Upload

Welcome to Scribd!

  • 106 views

    Antivirus: Presented By: Manoj Batra Yogesh Dubey

    Uploaded by

    yddubey
    Antivirus software detects and removes malware like viruses, worms, and trojans. It uses signature-based detection to check files against known virus signatures. Other identification methods include monitoring for malicious activity, file analysis, and file emulation. Issues with antivirus software include potential performance impacts, security risks if the software is exploited, unexpected renewal costs, and privacy concerns if files are automatically sent to developers.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd

    Antivirus: Presented By: Manoj Batra Yogesh Dubey

    Uploaded by

    yddubey
    106 views17 pages
    Antivirus software detects and removes malware like viruses, worms, and trojans. It uses signature-based detection to check files against known virus signatures. Other identification methods include monitoring for malicious activity, file analysis, and file emulation. Issues with antivirus software include potential performance impacts, security risks if the software is exploited, unexpected renewal costs, and privacy concerns if files are automatically sent to developers.

    Original Title

    Anti Virus

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Antivirus software detects and removes malware like viruses, worms, and trojans. It uses signature-based detection to check files against known virus signatures. Other identification methods include monitoring for malicious activity, file analysis, and file emulation. Issues with antivirus software include potential performance impacts, security risks if the software is exploited, unexpected renewal costs, and privacy concerns if files are automatically sent to developers.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    106 views17 pages

    Antivirus: Presented By: Manoj Batra Yogesh Dubey

    Uploaded by

    yddubey
    Antivirus software detects and removes malware like viruses, worms, and trojans. It uses signature-based detection to check files against known virus signatures. Other identification methods include monitoring for malicious activity, file analysis, and file emulation. Issues with antivirus software include potential performance impacts, security risks if the software is exploited, unexpected renewal costs, and privacy concerns if files are automatically sent to developers.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 17

    Antivirus

    Presented by:
    Manoj Batra
    Yogesh Dubey
    THREATS TO COMPUTER SECURITY

    • A threat is a potential violation of security.


    when a threat is actually executed, it becomes
    attack. Those who execute such actions , or
    cause them to be executed are called
    attackers.
    COMMON THREATS

    • Viruses
     Worms
     Trojans
    • Spyware
    • Adware
    • Spamming
    • PC Intrusion
     Denial of service
     Sweeping
     Password Guessing
    COMPUTER VIRUSES
    • Computer viruses are malicious codes/programs that cause
    damage to data and files on a system. It can attack any part of
    a computer’s software such as boot block, operating system,
    system areas, files and application-program –macros. Two
    other similar programs also cause virus like effects are:
     Worms : A worm is a self – replicating program which eats up
    the entire disk space or memory. A worm keep on creating its
    copies until all the disk space or memory is filled.
     Trojan Horses : A trojan horse is a program that appears
    harmless (such as a text editor or a utility program) but actually
    performs malicious functions such as deleting or damaging files.
    SPYWARE

    • Spyware is a software which is installed on


    our computer to spy on our activities and
    report this data to people willing to pay for it.
    It tracks the user’s behaviour and reports
    information back to a central source. These
    are used to spy on some one either for legal
    or illegal purpose.
    ADWARE

    • These are the programs that deliver


    unwanted ads to your computer (generally in
    Pop-ups form). They consume your network
    bandwidth. Adware is similar to spyware-
    however,it may be installed with your consent.
    So it is advised that you thoroughly read
    installation agreements before you allow
    installation of a software
    SPAMMING

    • Spamming refers to the sending of bulk - mail


    by an identified or unidentified source. In non-
    malicious form, bulk - advertising mail is sent
    to many accounts. In malicious form (e.g., e-
    mail bombing), the attacker keeps on sending
    bulk mail until the mail-server runs out of disk
    space. Spam has become the bane of the
    internet , and still there is no real solution in
    sight.
    PC INTRUSION

    • Every PC connected to the Internet is a potential target


    for hackers.PC Intrusion can occur in any of the following
    form:
     Sweeper Attack : It deletes all the data from the system.
     Denial of Services : It eats up all the resources of a
    system and makes it to come to a halt.
     Password Guessing : Most hackers crack or guess
    passwords of system accounts and gain entry into
    remote computer systems with malicious intension.
    Antivirus
    • Antivirus (or anti-virus) software is used to
    prevent, detect, and remove malware,
    including computer viruses, worms, and trojan
    horses.
    • Such programs may also prevent and remove
    adware, spyware, and other forms of malware
    Antivirus functioning
    Following strategies are typically employed:-
    • Signature-based detection in which no
    signature exists yet.
    • zero-day threats
    • heuristics
    – generic signatures
    • Sandbox
    Signature based detection
    Traditionally, antivirus software heavily relied upon
    signatures to identify malware. This can be very effective, but
    cannot defend against malware unless samples have already
    been obtained and signatures created. Because of this,
    signature-based approaches are not effective against new,
    unknown viruses.
    When antivirus software scans a file for viruses, it checks the
    contents of a file against a dictionary of virus signatures. A
    virus signature is the viral code. If a virus signature is found in
    a file the antivirus software can resort to some combination
    of quarantine, repair or deletion. Quarantining a file will
    make it inaccessible, and is usually the first action antivirus
    software will take if a malicious file is found. Encrypting the
    file is a good quarantining technique because it renders the
    file useless without the encryption key
    Antivirus
    Other Identification methods
    • Malicious activity detection is another approach used to
    identify malware. In this approach, antivirus software monitors
    the system for suspicious program behavior. If suspicious
    behavior is detected, the suspect program may be further
    investigated, using signature based detection or another
    method listed in this section. This type of detection can be used
    to identify unknown viruses or variants on existing viruses.
    • Heuristic-based detection, like malicious activity detection, can
    be used to identify unknown viruses. This can be accomplished
    in one of two ways: file analysis and file emulation
    Antivirus
    • File analysis is the process of searching a suspect file for virus-
    like instructions. For example, if a program has instructions to
    reformat the C drive, the antivirus software might further
    investigate the file. One downside of this feature is the large
    amount of computer resources needed to analyse every file,
    resulting in slow operation.
    • File emulation is another heuristic approach. File emulation
    involves executing a program in a virtual environment and
    logging what actions the program performs. Depending on the
    actions logged, the antivirus software can determine if the
    program is malicious or not and then carry out the appropriate
    disinfection actions
    Antivirus
    • An emerging technique to deal with malware in general is
    whitelisting. Rather than looking for only known bad software, this
    technique prevents execution of all computer code except that
    which has been previously identified as trustworthy by the system
    administrator. By following this "default deny" approach, the
    limitations inherent in keeping virus signatures up to date are
    avoided. Additionally, computer applications that are unwanted by
    the system administrator are prevented from executing since they
    are not on the whitelist. Since organizations often have large
    quantities of trusted applications, the limitations of adopting this
    technique rests with the system administrators' ability to properly
    inventory and maintain the whitelist of trusted applications. Viable
    implementations of this technique include tools for automating the
    inventory and whitelist maintenance processes
    Issues of concern

    • Performance
    – Some antivirus software can considerably reduce performance. Users may disable
    the antivirus protection to overcome the performance loss, thus increasing the risk
    of infection. For maximum protection, the antivirus software needs to be enabled all
    the time] — often at the cost of slower performance
    • Security
    • Antivirus programs can in themselves pose a security risk as they often run at the
    'System' level of privileges and may hook the kernel — Both of these are necessary
    for the software to effectively do its job, however exploitation of the antivirus
    program itself could lead to privilege escalation(Privilege escalation is the act of
    exploiting a bug or design flaw in a software application to gain access to resources
    which normally would have been protected from an application or user. The result is
    that the application performs actions with more privileges than intended by the
    application developer or system administrator. )and create a severe security threat.
    Arguably, use of antivirus software when compared to the principle of least privilege
    is largely ineffective when ramifications of the added software are taken into account
    Issues of concern

    • Unexpected renewal costs


    • Some commercial antivirus software end-user license agreements include a clause that the
    subscription will be automatically renewed, and the purchaser's credit card automatically
    billed, at the renewal time without explicit approval. For example, McAfee requires users
    to unsubscribe at least 60 days before the expiration of the present subscription while
    BitDefender sends notifications to unsubscribe 30 days before the renewal. Norton
    Antivirus also renews subscriptions automatically by default.

    • Open source and free software applications, such as Clam AV, provide both the scanner
    application and updates free of charge and so there is no subscription to renew
    • Privacy
    • Some antivirus programs may be configured to automatically upload infected or suspicious
    files to the developer for further analysis. Care should be taking when deploying antivirus
    software to ensure that documents containing confidential or proprietary information are
    not sent to the product's developer without prompting the user.
    Issues of concern

    • System related issues


    • Running multiple antivirus programs concurrently can degrade performance
    and create conflicts It is sometimes necessary to temporarily disable virus
    protection when installing major updates such as Windows Service Packs or
    updating graphics card drivers. Active antivirus protection may partially or
    completely prevent the installation of a major update.

    • Mobile devices
    • Viruses from the desktop and laptop world have either migrated to, or are
    assisted in their dispersal by mobile devices. Antivirus vendors are beginning
    to offer solutions for mobile handsets. These devices present significant
    challenges for antivirus software, such as microprocessor constraints,
    memory constraints and new signature updates to these mobile handsets

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy