The Anti-virus Times

Tuesday, September 5, 2017

An anti-virus is the most common means of protection against malware, but it is far from the only means.Take, for example, vaccines (immunisers).

Vaccines appeared quite a while ago, virtually simultaneously with anti-viruses. Back then viruses, which are known to infect other files, were the most common pieces of malicious code. From a user's standpoint it’s entirely logical to think that before compromising a file, a virus should check whether it infected the file in the past.

If that’s true, one can determine the kind of data a virus will look for before infecting a file, append the data to the file, and voilà—no infection will occur! Note: this is achieved without using an anti-virus.

By the way!

But this only goes smoothly on paper.Vaccines modify files and this gives rise to other insoluble problems.

• There are a lot of viruses. Well, actually, that’s an understatement. THERE ARE TONS OF THEM.If the key properties of all the viruses were to be written into a file that requires protection, you would end up with a monster-sized piece of data. And, it would probably be unusable

  Today vaccines have almost fallen out of use because in previous years, malfunctioning vaccines inflicted significant damage to user data.

  http://www.psciences.net/main/sciences/computer_sciences/articles/antivirusy.html

• Even if one could manage to put all vaccines into a file (and continuously add in newly discovered ones), imagine how big the virus signatures would make the executable files, both on the hard drives and in the memory. It was in "ancient "times" that executable files numbered in the dozens. Now there are thousands of them.

• Many people complain that their anti-virus utilizes CPU and memory resources. But imagine vaccine code being written into every single protected file after each update (e.g., once an hour). That would slow down your system alright!

• Nowadays many files come with digital signatures that protect their integrity. Writing a vaccine into a file changes the file and it becomes unsigned. Among other things, this means that anti-viruses won't be able to rely on application signatures and will start scanning them—this will require additional hardware resources.

• The only way to update an altered (in essence, corrupted) file is to overwrite it completely. And this, by the way, will require the vaccine to be appended to the file after each update, and that means the vaccine application has to monitor the protected files for changes. And this will require a file operation driver and a self-protection driver.

• The creation of a vaccine requires considerably more skill on the part of virus analysts working in anti-virus laboratories. If, to create a malware signature, they merely need to find the virus's body, to come up with a vaccine, they will also have to understand how the virus operates and what kind of data it looks for when it examines files.

And here’s the last nail in the coffin: who says viruses always inspect the files they target? If they’re aware of a vaccination, they can start infecting files indiscriminately.

And that’s just the tip of the iceberg—it’s quite possible that using a vaccine could unleash many other problems.

There are vaccines against Trojans too. But those are specific files or markers in various system areas. Their drawbacks are similar to the problems we've described above.

That is, even if a vaccine is present, the Trojan will be launched anyway!