Examples of these symptoms are: reduced performance, increase in file length, less memory available, and strange screen displays. What can be done for protection?
The easiest way to keep a system virus-free is to check anything before it is used. A normal operating system offers different services to the user. The anti-virus programs run these services through a memory resident monitor. When the user asks for a file to be opened, the monitor opens it to check for viruses. If the file is "clean", the monitor allows the user to open the file. If the requested file is infected, then the monitor notifies the user. The user will then be able to decide what option to take with the infected file. All of this is carried out so fast that the user does not even realize it. Despite the monitor’s activity, the user should scan the computer frequently (once a week). The scanning can be done by using one or more of the following methods:· Signature Scanning - The product will compare a file and its contents against a database of signatures. This requires frequent updates to give the user adequate protection of his/her PC.· Heuristic Analysis - The anti-virus product will try to detect virus-like activity inside the user’s computer. The major downside to this type of analysis is the occurrence of false alarms.· Check Sum Analysis - The virus must make changes to the infected program> If the anti-virus program detects this it could notify the user. The problem with this method is that just loading a clean program onto the computer can cause changes and the novice user can not distinguish between the changes caused by a virus and those that are normal.· Polymorphic Analysis - As the polymorphic viruses change each time they infect, a special type of analyzer is needed. The anti-virus product will check the file for any virus-like behavior in a secluded location in the disk.· Macro Analysis - This analyzer intercepts the macros in a file and checks for viruses before opening them in the file. How can the virus be removed?
After the anti-virus product has found an infected file, it should be able to remove the file, thereby "curing" it. This process is extremely important. If the virus is infecting the user’s computer and the user now knows that it is in the hard disk, there will be no rest until the virus is removed. The problem is to remove the virus and leave the file intact. If the cure is not done correctly, the anti-virus product will leave the file in a non-working state (possibly the original purpose of the virus). This is the difference between a "good" cure and a "bad" cure.