Antivirus Software Technology By Mitchell Zell

Intro  Computers are vulnerable to attack  Most common type of attack is Malware  Short for malicious software  Definition of Malware:  Software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Types of Malware  Virus  Worm  Trojan Horse  Logic Bomb  Rootkit  Spyware

:53-4:22

Virus  Small software programs that are designed to spread from one computer to another and to interfere with computer operation  Commonly spread through or instant messaging  Can be hidden in other software you download

Worm  A computer program that has the ability to copy itself from machine to machine  Commonly spread through networks

Trojan Horse  Dangerous programs that hide within other seemingly harmless programs  By downloading the intended program, the Trojan Horse has full access to the computer.  It can damage the computer  It can send important sensitive information over the internet and back to the creator of the Trojan Horse

Logic Bomb  A piece of computer code that executes a malicious task, such as clearing a hard drive or deleting specific files, when it is triggered by a specific event  Planted in the computer ahead of time  Triggered by the person who planted it  Positive triggers  Individual sends command to trigger Logic Bomb  Negative triggers  Lack of input from an individual triggers Logic Bomb

Rootkits  A Rootkit is a type of software designed to hide the fact that an operating system has been compromised  Disguised as necessary files which antivirus software overlooks

Spyware  A type of malware installed on a computer without the knowledge of the owner in order to collect the owner’s private information  Can save information such as passwords and other private information

Antivirus Software  Designed to detect, prevent, and remove malicious software  Scans for viruses by looking for the Virus Signature  Algorithm or hash (a number derived from a string of text) that uniquely identifies a specific virus

Antivirus Software (con’t)  Since virus signatures are becoming more complex, new technology is used  HIPS  Behavior Blocking

HIPS  Host Intrusion Prevention System  Monitors each activity a program attempts and prompts the user for action or responds based on predefined criteria  In basic terms, HIPS watches the activity of applications and declares that each application can do certain activities, but not others  It allows the application to function normally, but prevents it from performing tasks it is not authorized to perform

Behavior Blockers  Monitor and profile whole program behavior  When a collection of behaviors tips the scale, the behavior blocker will alert the user or take action against the entire program based on predefined criteria  Focus on entire program instead of individual actions  Determines that a program is harmful and quarantines it  Easier to use

Security  Virus Signatures are becoming more complex  Antivirus software passes over newer signatures  To counteract this, multiple layers of security should be used

Works Cited  Technology.htm Technology.htm         Software.htm Software.htm  