VIRUS

A computer virus is a type of malicious code or program, which prevents the computer to do the
normal operation.It can replicate itself and can be transferred from one computer to another
computer.

ANTIVIRUS
Antivirus also known as anti-malware, is designed to detect, prevent and remove malicious
software from our computer such as viruses, worms and Trojan horses.

How does an antivirus work?

When a computer virus infects a computer, it makes changes to files on our computer.
These files may be user or system files.
An antivirus program protects a computer by monitoring all file changes and the
memory for specific virus activity patterns. When these virus patterns are detected, the
antivirus warns the user about it and then performs the action.

Virus Detection Techniques by Antivirus

There are four popular anti virus detection techniques:
1. Signature based detection
2. Generic detection
3. Heuristic detection
4. Sand box detection

1. Signature based detection:

Every antivirus has a virus definition file, database or dictionary that contains thousands
of known virus signatures. During scanning of files, if any file that matches with any
signature in dictionary, anti virus informs the user and may take one of the following
actions:
attempt to repair the file by removing the virus itself from the file
quarantine the file
or delete the file completely
Signature-based detection is an excellent way to prevent past known viruses. However,
signature-based detection cannot detect new viruses until the definition file is updated
in the dictionary.
2. Behavioural-based detection
This type of detection is used to detects malware only while the virus runs in computer.
If a program begins to perform malicious actions, the antivirus may trigger a warning.

3. Heuristic-based detection
 It uses an algorithm to compare the signature of known viruses against a potential
threat. Heuristic-based detection allows an antivirus to detect viruses that have not yet
been discovered or previous viruses that have been modified or disguised and released
as a new virus.
Heuristic-based scanning is the best-known method for detecting new viruses .
4. Sandbox detection
In this approach an antivirus program will take suspicious code and run it in a virtual
machine (emulated computer) to see the purpose of the code and exactly how the
code works. After the program is terminated the software analyzes the sandbox for any
changes, which might indicate a virus.