The Anti-virus Times

Wednesday, October 4, 2017

When in now distant 1992, Igor Danilov embarked on developing Dr.Web software, he could hardly have imagined an anti-virus being regarded as a threat to some country’s national security. But just 25 years have gone by…

We won't deny that as far as PCs are concerned, an anti-virus's power in a system is practically unlimited. It can create, delete, and modify any files, and analyse the contents of documents, images, and database files. And this is quite natural because malware can be anywhere.

On the other hand, a faulty anti-virus update can make the operating system freeze by mistakenly deleting a system file or registry entry. But updates for any other application can cause as much harm. ANY. So apprehensions about potential threats coming from updates, including those of an anti-virus, aren't entirely unsubstantiated.

If an anti-virus is a threat, is it possible to be protected from it? In theory, one can demand that its developer validate all virus and anti-spam database updates and preventive protection routines by submitting those to some regulating agency. But updates are released at least once an hour, and they can't be delayed. That’s because a delay may enable a system to be penetrated by brand new malware programs which appear in the thousands on a daily basis. That's why screening anti-virus updates is only possible in theory.

In reality, controlling update sources is the most common way to protect computers from "malicious" updates.

For example:

Naturally, if a software program receives its updates from a different jurisdiction and its developers aren't subject to the laws of the countries in which the software is being sold, the possibility exists that the software may contain undocumented features. Not a single example of a malicious update being released for an anti-virus exists in the history of the anti-virus industry! Such an update would mean death for an anti-virus developer. And the death would be instantaneous. No customer would ever excuse such a thing even if it happened unintentionally. By the way, this is one reason why virus analysts and programmers seeking employment, for example, at Doctor Web, are scrutinised as if they were applying for a job in the secret services. All of a candidate’s criminal and hacker connections are traced no matter how far in the past they are (so if you want to work at Doctor Web, don't get involved in shady enterprises).