Heuristics or Signatures?

Aug 29, 2007 13:10 GMT  ·  By

What's the best type of AV? And how do I protect myself? These are common questions these days so I'm going to rant about this a little bit so that people can get a better idea on how things stand...

Anti-viruses have two approaches on malware. One is for them to know the threat by its signature. How do they do that? Well, any known threat has a certain code of its own. The program is basically instructed to recognize a certain piece of code as belonging to a virus, so when it sees a file with that code it immediately takes it out. That is one thing, and this is as accurate as it can get, but there is one thing - malware pops up everyday and anti-viruses that work this way have no idea a certain application might be a virus if they never encountered it before. That's why it's a good thing to keep your anti-virus up-to-date.

Also, there is another way this programs may work. Some use both methods, while some use only one. In any case, the second one is heuristics - the software simply "knows" which applications are malignant because it "sees" the way in which they behave and flags them as malware instantly. They know how trojans, worms and others act and the minute they spot a certain behavior, the threat is "kaput"!

I consider heuristics-based anti-viruses to be more efficient when encountering new threats, but they have flaws as well. Some of these may flag normal non-malignant applications as malware because they "think" they are viruses. A very well known example is when a few years ago, the Syamantec people were showing off their new AV. The PC that had the firm's product on had Kaspersky AV installed on it as well. Guess what Kaspersky said about Norton! Yep - it deemed it malware!

One thing that is good to know though is the fact that when a hacker wants to attack you, he or she will first try to get info about your computer. The thing is that there is an anti-reconnaissance technology that sends bogus data about your PC to the hacker that wants to know stuff about your machine. So get the proper security soft on your PC and hackers will have a hard time getting into your system!