+- Sinisterly (https://sinister.ly)
+-- Forum: Computers (https://sinister.ly/Forum-Computers)
+--- Forum: Antivirus & Protection (https://sinister.ly/Forum-Antivirus-Protection)
+--- Thread: [Guide] What is an Antivirus and How to choose one? (/Thread-Guide-What-is-an-Antivirus-and-How-to-choose-one)
Pages:
1
2
[Guide] What is an Antivirus and How to choose one? - Ex094 - 02-24-2013
Before starting we should know what an Antivirus is:
Code:
Antivirus or anti-virus software is software used to prevent, detect and remove malware (of all descriptions), such as: computer viruses, malicious BHOs, hijackers, ransomware, keyloggers, backdoors, rootkits, Trojan horses, worms, malicious LSPs, dialers, fraudtools, adware and spyware. Computer security, including protection from social engineering techniques, is commonly offered in products and services of antivirus software companies - WikipediaWorking of an antivirus is a complicated matter as it uses different methods and algorithms to search for the target. Some of the method which a common antivirus uses are:
Code:
1) Signature Based Detection
2) Heuristics
3) Rootkit detection
4) Real Time protection
5) File EmulationSignature Based Detection:
The most common method of detection is the Signature Based Detection, each virus carries a specific signature that distinguishes it from other files. The AV using this method detects the signature of the virus and compares it with the database of signature it has via Virus Updates. Viruses have evolved and they can easily bypass this detection using polymorphic etc. encryption method hence their signature doesn’t gets found and Av treats it as a normal program.
Heuristics:
Modern Malware use mutation methods to keep themselves from being detected and make copies of themselves over time. Most of Antivirus feature the Heuristic detection methods which help in identifying the malware and its other variants (Mutated form of the original malware). If you want to understand mutation of code at a normal level have a look at one of our Guide. The programming language used in that guide is Python so be sure you know the basics.
Rootkit Detection:
Rootkits are the real pain, if your system is infected with a rootkit then you should and MUST perform a full format on that infected partition and reinstall your OS. Rootkits gain admin access to your system anonymously and can tamper data. They can alter Antivirus settings and render them passive so that it doesn’t have any effect of its function.
Real Time Protection:
Now days each and every antivirus software possesses this feature, An AV software keeps on running in the background and scans for suspicious behavior, files, and registry changes and reports to the user. This is also known as Auto Protection.
File Emulation:
This is also known as sandbox, it’s also a heuristic process in which a suspicious program is ran in a totally virtual environment (Out of reach of your files). The antivirus then monitors the activity of the program, if it’s a virus or a malware then the AV tries to disinfect it while notifying the user.
How to Choose One?
Now as you are familiar with how an antivirus work by now you also have understood which qualities and features an Antivirus should possess, Let me list some of those:
Code:
1) Firewall
2) Boot Time scan
3) Fast Detection rate
4) Regular Updates
5) Real Time Protection
6) Heuristics
7) Sandbox (File Emulation)
8) Rootkit Detection
9) Web Protection
10) Macro Protection (Document Embedded Viruses)
11) On Demand Scan
12) Antivirus Tests
13) Antispam
14) LicenseThe most important of those features which an AV should have are:
Firewall, Boot time scan, Fast Detection Rate, Regular Updates, Real time protection, heuristics, rootkit, macro protection and last but not least sandbox.
I will now state each of their individual reasons that why an AV should have features like so:
Firewall:
Firewall is necessary to monitor the incoming and outgoing connections. A hacker might be able to connect to one of OS open ports if one has no proper firewall.
Boot Time Scan:
Necessary when your OS main file like the explorer.exe are infected. While OS is operating an AV can’t disinfect those file because they are in use so the best way to disinfect your system would be to perform a boot time scan.
Detection Rate:
Better the detection rate, the faster your AV will identify the virus. A AV with a low detection rate will take much time in analyzing and detecting a suspicious Malware program.
Regular Updates:
Regular updates mean that your antivirus has more information about latest viruses, malware etc. With a fast detection rate and regular updates your AV can pick up any virus instantly.
Real Time Protection:
Real time protection give you an extra edge on security, as you are working the AV program works in the background scanning for suspicious files etc. hence your AV is aware of your system.
Heuristics:
Modern viruses and malware use the mutation method to make copies of itself in another program changing its code so if one of the malware gets detected the other one might not as it has a changed code. This is a serious feature any AV you plan to get must have!
Rootkit Scanning:
Rootkits can alter your Antivirus settings and make it unable to perform its task. It’s better to have an AV of rootkit scanner and a good detection rate so that the rootkit gets detected before it even infects the host system.
Macro Protection:
Document files are used every day, hackers have found a way to embed virus and malwares in document macros (Refer to Wikipedia). Hence it’s necessary for an AV to detect macro viruses present within documents and alert the user before they execute it.
Sandbox:
This is an important features now a days as it makes the work of an AV easy and prevents data loss and infection. It executes a suspicious program in a virtual environment so that if it’s a malware the AV can quickly disinfect it.
License:
Most people use cracked versions of AV or serials that are not genuine. This effects the working of an AV whether if you know it or not. Anyone you ask will suggest that you should get a licensed and registered version of an Antivirus, You can Google that if you don’t trust me.
Now you should have a basic idea of which type of Antivirus you should get either it’s a free or professional version. Remember that features differ in every version, if a free edition has got the necessary one then you should not hesitate in getting it. If you want to be extra sure that your AV is bullet proof then try self-testing method.
Self-testing Method:
This method is usually easy but it is recommended that you perform this in a virtual environment to keep track of your AV Detection rate and performance.
Just Goto Malware bytes Malware Sample testing forum section and download the strongest one, Unpack the malware to a location (turn AV off before that) and then turn on your AV. You can get many of the samples on the net be sure to pick the right one.
Last words, ‘Noting is secure, so don’t expect too much from your software’.
You can download this whole guide in a better format (.pdf) from here: Download PDF
Guide Written By Exo94
Do not leech or rip. If shared, give proper credits!
[Guide] What is an Antivirus and How to choose one? - Ex094 - 02-24-2013
Before starting we should know what an Antivirus is:
Code:
Antivirus or anti-virus software is software used to prevent, detect and remove malware (of all descriptions), such as: computer viruses, malicious BHOs, hijackers, ransomware, keyloggers, backdoors, rootkits, Trojan horses, worms, malicious LSPs, dialers, fraudtools, adware and spyware. Computer security, including protection from social engineering techniques, is commonly offered in products and services of antivirus software companies - WikipediaWorking of an antivirus is a complicated matter as it uses different methods and algorithms to search for the target. Some of the method which a common antivirus uses are:
Code:
1) Signature Based Detection
2) Heuristics
3) Rootkit detection
4) Real Time protection
5) File EmulationSignature Based Detection:
The most common method of detection is the Signature Based Detection, each virus carries a specific signature that distinguishes it from other files. The AV using this method detects the signature of the virus and compares it with the database of signature it has via Virus Updates. Viruses have evolved and they can easily bypass this detection using polymorphic etc. encryption method hence their signature doesn’t gets found and Av treats it as a normal program.
Heuristics:
Modern Malware use mutation methods to keep themselves from being detected and make copies of themselves over time. Most of Antivirus feature the Heuristic detection methods which help in identifying the malware and its other variants (Mutated form of the original malware). If you want to understand mutation of code at a normal level have a look at one of our Guide. The programming language used in that guide is Python so be sure you know the basics.
Rootkit Detection:
Rootkits are the real pain, if your system is infected with a rootkit then you should and MUST perform a full format on that infected partition and reinstall your OS. Rootkits gain admin access to your system anonymously and can tamper data. They can alter Antivirus settings and render them passive so that it doesn’t have any effect of its function.
Real Time Protection:
Now days each and every antivirus software possesses this feature, An AV software keeps on running in the background and scans for suspicious behavior, files, and registry changes and reports to the user. This is also known as Auto Protection.
File Emulation:
This is also known as sandbox, it’s also a heuristic process in which a suspicious program is ran in a totally virtual environment (Out of reach of your files). The antivirus then monitors the activity of the program, if it’s a virus or a malware then the AV tries to disinfect it while notifying the user.
How to Choose One?
Now as you are familiar with how an antivirus work by now you also have understood which qualities and features an Antivirus should possess, Let me list some of those:
Code:
1) Firewall
2) Boot Time scan
3) Fast Detection rate
4) Regular Updates
5) Real Time Protection
6) Heuristics
7) Sandbox (File Emulation)
8) Rootkit Detection
9) Web Protection
10) Macro Protection (Document Embedded Viruses)
11) On Demand Scan
12) Antivirus Tests
13) Antispam
14) LicenseThe most important of those features which an AV should have are:
Firewall, Boot time scan, Fast Detection Rate, Regular Updates, Real time protection, heuristics, rootkit, macro protection and last but not least sandbox.
I will now state each of their individual reasons that why an AV should have features like so:
Firewall:
Firewall is necessary to monitor the incoming and outgoing connections. A hacker might be able to connect to one of OS open ports if one has no proper firewall.
Boot Time Scan:
Necessary when your OS main file like the explorer.exe are infected. While OS is operating an AV can’t disinfect those file because they are in use so the best way to disinfect your system would be to perform a boot time scan.
Detection Rate:
Better the detection rate, the faster your AV will identify the virus. A AV with a low detection rate will take much time in analyzing and detecting a suspicious Malware program.
Regular Updates:
Regular updates mean that your antivirus has more information about latest viruses, malware etc. With a fast detection rate and regular updates your AV can pick up any virus instantly.
Real Time Protection:
Real time protection give you an extra edge on security, as you are working the AV program works in the background scanning for suspicious files etc. hence your AV is aware of your system.
Heuristics:
Modern viruses and malware use the mutation method to make copies of itself in another program changing its code so if one of the malware gets detected the other one might not as it has a changed code. This is a serious feature any AV you plan to get must have!
Rootkit Scanning:
Rootkits can alter your Antivirus settings and make it unable to perform its task. It’s better to have an AV of rootkit scanner and a good detection rate so that the rootkit gets detected before it even infects the host system.
Macro Protection:
Document files are used every day, hackers have found a way to embed virus and malwares in document macros (Refer to Wikipedia). Hence it’s necessary for an AV to detect macro viruses present within documents and alert the user before they execute it.
Sandbox:
This is an important features now a days as it makes the work of an AV easy and prevents data loss and infection. It executes a suspicious program in a virtual environment so that if it’s a malware the AV can quickly disinfect it.
License:
Most people use cracked versions of AV or serials that are not genuine. This effects the working of an AV whether if you know it or not. Anyone you ask will suggest that you should get a licensed and registered version of an Antivirus, You can Google that if you don’t trust me.
Now you should have a basic idea of which type of Antivirus you should get either it’s a free or professional version. Remember that features differ in every version, if a free edition has got the necessary one then you should not hesitate in getting it. If you want to be extra sure that your AV is bullet proof then try self-testing method.
Self-testing Method:
This method is usually easy but it is recommended that you perform this in a virtual environment to keep track of your AV Detection rate and performance.
Just Goto Malware bytes Malware Sample testing forum section and download the strongest one, Unpack the malware to a location (turn AV off before that) and then turn on your AV. You can get many of the samples on the net be sure to pick the right one.
Last words, ‘Noting is secure, so don’t expect too much from your software’.
You can download this whole guide in a better format (.pdf) from here: Download PDF
Guide Written By Exo94
Do not leech or rip. If shared, give proper credits!
RE: [Guide] What is an Antivirus and How to choose one? - Techie - 02-24-2013
Great HQ tutorial, nice work bro.
RE: [Guide] What is an Antivirus and How to choose one? - Techie - 02-24-2013
Great HQ tutorial, nice work bro.
RE: [Guide] What is an Antivirus and How to choose one? - Ex094 - 02-24-2013
(02-24-2013, 03:22 PM)τhε.τhinkεr Wrote: Great HQ tutorial, nice work bro.Thank you for your reply! Glad you like it. I've written it for all who say 'Which is the best Antivirus?'.
RE: [Guide] What is an Antivirus and How to choose one? - Ex094 - 02-24-2013
(02-24-2013, 03:22 PM)τhε.τhinkεr Wrote: Great HQ tutorial, nice work bro.Thank you for your reply! Glad you like it. I've written it for all who say 'Which is the best Antivirus?'.
RE: [Guide] What is an Antivirus and How to choose one? - ascwhitehat - 02-25-2013
nice work useful thread ts
RE: [Guide] What is an Antivirus and How to choose one? - Ex094 - 02-25-2013
(02-25-2013, 05:39 PM)ascwhitehat Wrote: nice work useful thread tsThank you!
RE: [Guide] What is an Antivirus and How to choose one? - Roxy_30 - 06-03-2013
Great post. Preciate you uploading this. Fully xplains vrything needed to know about AV. Thanks
RE: [Guide] What is an Antivirus and How to choose one? - Ex094 - 06-03-2013
(06-03-2013, 05:58 PM)Roxy_30 Wrote: Great post. Preciate you uploading this. Fully xplains vrything needed to know about AV. Thanks
Glad my tutorial helped you
