Malware And Antivirus Software

(SANEPR.com) July 15, 2008 -- Warning: most antivirus programs will not protect you against all forms of malignant software (often called "malware") on their own. Find out how to protect yourself.

Sure, your antivirus software will protect you against viruses. It will probably even do a good job against worms. But what Trojans, exploits, backdoors, spyware and the dozen other nasty software parasites?

Malware and Antivirus Software: a History

The war on computer viruses has led to an arms race between the designers of antivirus software and the designers of viruses (you didn't think viruses just created themselves did you?). Some years ago, virus designers responded to ever more successful antivirus software by creating the descendents of viruses, worms, which did not infect files but rather installed themselves directly on the hard drive, making them harder to detect.

The arms race has since led to a total of at least eleven distinct types of what is now called malware, a neologism meaning bad (as in malignant rather than shoddy) software. According to Wikipedia, these eleven types of malware are:

1. Virus
2. Worm
3. Wabbit
4. Trojan
5. Backdoor
6. Spyware
7. Exploit
8. Rootkit
9. Key Logger
10. Dialer
11. URL injection

There's a twelfth kind of malware: adware, which Wikipedia considers simply to be a subset of spyware.

Why Antivirus Software Isn't Enough for Malware

As you can see, makers of antivirus software have their work cut out for them if they're going to keep every instance of malware off your system. As a result, antivirus software makers have often had to pick their battles. Adware, whose makers often claim they are doing nothing illegal or even questionable, often gets treated more lightly.

Even when antivirus software makers do come out with a product that fights all twelve or so kinds of malware, responding to each new instance of malware to come on the market isn't easy. First the malware has to be identified, which means someone's computer, and probably tens of thousands of computers, will be infected first. Then, the malware has to be dissected. Then a removal program and a filter must both be written. Then the removal program and filter must be tested to make sure they work, and that they don't interfere with any other functions of the antivirus software or the computer itself. When a fix for the virus is out, it then has to be loaded into an antivirus software update and transmitted to every single computer worldwide that has the antivirus software installed.

The speed with which antivirus software makers are able to deliver updates for newly discovered malware would impress even Santa Claus. Yet there's still a crucial window of one to a few days between when the new malware has reached a critical mass of thousands of computers, and when the update is released. If your antivirus software is not set to check for updates automatically every hour or so, that window opens even wider.

Practically speaking, then, you're better off having more than one line of defense against malware. Even if two different anti-malware programs utilize the exact same database, there might be a crucial difference in the speed of getting updates. It makes sense to back up your antivirus software with anti-spyware software. When you consider that dedicated anti-spyware software developers make protection against the non-virus forms of malware their stock-in-trade, you can see why anti-spyware software is so essential. In fact, you should strongly consider having two anti-spyware programs running on your computer at all times, since the gap in updates between two anti-spyware programs can be even longer than for two antivirus programs.

After all, with a dozen kinds of malware out there, shouldn't you at least have two pieces of software to fight them?