Antivirus - what for?

Antivirus - what for?

Antivirus software is often seen as annoying. At the most inopportune moments, warnings appear that disturb your concentration and interrupt your workflow. Occasionally, an overzealous antivirus will even block legitimate software.

Time for a quick look under the bonnet: What do antivirus programs actually do? How do they work? And is it still worth spending money on virus protection?

How infection and malware security can help you. 

Antivirus (AV) software manufacturers like to claim that without them you would be lost. Or at least your data. However, some Windows users take the opposite view: antivirus software reduce system performance, annoy users with unnecessary warnings and block completely harmless applications while malicious software can still slip through.

While antivirus software can be extremely annoying, it still provides an indispensable safety net. Without an antivirus, you would have to be extremely careful every time you share data with others to prevent malware infections. In other words: without virus protection, there is no internet.

Basically, all current antivirus programs take a similar approach to protecting against malicious software (“malware”). Their ongoing insurance modules check all records surprisingly. A web protection module tries to prevent access to malicious websites. And an "on-demand scanner" checks all local data for possible infections.

All of these modules require computing power; that is, they slightly reduce system performance. However, several methods are used to reduce this negative performance impact. One of them is a tiered approach to malicious software identification.

 

The easiest way to identify threats is to match the code with "signatures" of known malware. In simple terms, it is a matter of checking whether the file to be analyzed matches a checksum from a blacklist (a “blacklist”).

This approach has the disadvantage that attackers can circumvent detection based on the signature by making small changes to the program code. This is why heuristic analysis comes into play, in which the antivirus program expands the detection criteria by comparing a broader pattern, for example a specific piece of program code instead of the entire file.

Heuristic analysis has the advantage that it easily detects variants of a threat. But - and there is always a "but" to antivirus software - because heuristics involve a certain amount of speculation, they are prone to mistaking legitimate applications for malware.

Another approach is behavior analysis. Suspicious applications are initially executed in a "sandbox" that is isolated from the operating system. However, this detection method is very resource-intensive - that is, if it is executed on your computer, sandboxing can significantly affect computer performance.

In order to alleviate these problems, antivirus developers have developed what is known as "online reputation systems". If the local antivirus program is unsure about a file, it can contact its developer's server directly to check whether it is found in a central whitelist. If the code is known to be harmless, it is executed. If the code is unknown, it is sent to the manufacturer's server as a sample for central analysis. There the example is run in a virtual Windows environment, where its behavior is checked for unusual activity.

The entirety of this normally occurs without clients agonizing over it. Think of antivirus programs as friendly little elves who work in the background and protect you. Occasionally, however, elves make mistakes.

 

When antivirus programs go crazy

Despite the security precautions of whitelists and online reputation checks, antivirus programs occasionally overshoot. Harmless software is blocked and access to harmless websites is blocked. These errors are known as false positives.

A current example of a false positive is provided by Comodo Internet Security Pro, which in certain situations prevents users from using SoftMaker Office 2018. With the standard settings, the firewall integrated in Comodo can block access to the SoftMaker license server. As a result, the software cannot check the validity of the license and the activation will fail.

Software developers affected by such an issue have little choice but to contact the antivirus vendor, convince them of the legitimacy of their software, and request that their product be whitelisted by the company. This can take a while. In the meantime, users have to help themselves.

In the case of Comodo Internet Security Pro and SoftMaker Office 2018, successful activation is currently only possible if the "Web filter" module of the antivirus program is deactivated. This is done by calling up the Comodo Internet Security settings and navigating to Web Filters . In this section you should deactivate the setting "Activate web filter (recommended)" and confirm your choice with OK.

Basically, of course, you should be very careful when disabling elements of your antivirus protection. The best solution is to create exceptions for certain applications - this basically creates a local whitelist. However, before adding such an exception, you should double-check whether it compromises the security of the computer. Fortunately, there are a number of free online services that can help with this assessment.

How to check whether a file is safe

Some antivirus programs are very strict: suspicious files are quickly deleted or sent to “quarantine”, a special container in which they cannot cause any damage. This usually happens before the anti-virus program issues a warning.

There are several ways to check if such a file is a false positive or as malicious as the antivirus software thinks it is. Often times, you need to restore the file from quarantine first. Since this is done differently from application to application, you should read the documentation for your virus protection program. To avoid removing the restored file immediately, you may need to create a temporary exception first.

You can then upload the file to an online virus scanner such as HerdProtect , Jottis Malware Scan , Opswat Metadefender Cloud or VirusTotal . Make sure you never double-click on a suspicious file before uploading! The service will check the upload with several virus scanners, which can take a few minutes.

Online virus scanner results are sometimes difficult to interpret. However, if more than a couple of these services agree that the file is malicious, then your local antivirus was probably right. Particular care should be taken with results that are marked as heuristic results (often marked as “heur”). As already mentioned, the heuristic analysis is quite error-prone.

Online virus scanners are not perfect: it can actually happen that none of the scanners recognizes the harmfulness of an uploaded file. This can particularly occur with files that you have received as e-mail attachments. This type of malware is often tailored to bypass virus protection.

As a rule, antivirus manufacturers discover such hide-and-seek games within a few hours. So if after the first analysis you are still suspicious of a file, leave it for a few hours and then upload it again. This often leads to significantly different results, which should dispel any doubt.

However, be careful when uploading personal data to online virus scanners. Most of them forward suspicious files to individual antivirus providers for further analysis. This is usually noted in the terms of use of an online scanner - but who reads them?

 

How to choose your virus protection

As a private Windows user, you have a useful anti-virus solution with Windows Defender. It was developed by Microsoft and therefore integrates seamlessly with Windows. Windows Defender relies on both signature and online reputation checks. It tries to be as inconspicuous as possible - even though it's free.

All of the other free antivirus programs are essentially advertisements for their commercial brethren. That means they get more attention because they have to sell a product. Windows Defender follows a different business model.

If you use your computer for business, Windows Defender may not be your best choice. Use of the software requires active participation in "SpyNet", Microsoft's somewhat clumsily named reputation service. At the point when Windows Defender discovers dubious documents on a PC, it transfers them to Microsoft without inquiring. Confidential data may be passed on to third parties.

The reason for this behavior is that Microsoft also offers a commercial anti-virus solution called "Endpoint Protection" for corporate customers. In principle, Windows Defender “feeds” the “Endpoint Protection” product with malware samples.

Professional users will prefer a commercial antivirus solution instead. Most of them offer the option of refusing to upload suspicious files, even if it can lower the level of protection. In addition, they offer additional layers of protection - some of them useful, others rather questionable.

Commercial providers of antivirus programs usually offer several packages with different functions and price levels: The basic antivirus program only offers the most basic functions. The internet security package in the medium price range includes additional functions such as secure browsing environments for online banking, ad blockers, password safes and child protection. And the luxury version offers even more additional functions, many of which are of questionable use.

When choosing a package, the first thing to do is to install a trial version to familiarize yourself with the application and determine if the package meets your needs. Take the time to see if the application is trying to "lock you up", that is, forcing you to use the product permanently.

Password stores, for example, are generally a very good idea, but those bundled with internet security packages often lack the ability to export the data in a format that other password stores can read. In the worst case scenario, you might have an inferior antivirus program on your neck just because it is holding your passwords hostage.

Tools to "tune" or "clean" the operating system are also of dubious use, as Windows already includes features such as disk cleanup and memory optimization to free up space on the hard drive. A “registry cleaner” can even damage the operating system, and Microsoft has been known to not provide support to customers who use such programs.