The Anti-virus Times

Tuesday, March 3, 2020

It is well known that installing and running two anti-viruses on the same computer can have dire consequences. However, some security standards across the world do recommend that more than one anti-virus be used within an infrastructure. Who’s right? Let's try to find out.

Fair enough. The more tasks being performed, the more memory and CPU power required. However, our avid readers will object to making an anti-virus scan USB drives automatically as soon as they are plugged into a computer, because many people remove flash drives without using the Safely Remove hardware feature. If they unplug their device while scanning is in progress, they may lose their data.

But this is not entirely true. First, if a file is being downloaded from the Internet, it will most likely be scanned in real time while the data is being transferred (in the case of Dr.Web, this task will be performed by the HTTP monitor SpIDer Gate). But suppose the anti-virus hasn't checked the file while it was being downloaded. A file monitor (Dr.Web SpIDer Guard) can examine files while they are being opened and closed and in paranoid mode this component will scan files whenever data is written into them. If a file has been downloaded, there is little utility in checking it while it is being closed—a closed file poses no threat and scanning it will only waste system resources. It is more expedient to examine the file when it is opened again. But let's assume that all the anti-viruses have rushed to scan a newly modified file. You also need to understand that an operating system can't perform these actions concurrently (well, as a matter of fact, modern multi-core systems can do that, but one has to be very careful because if the same file segment is being processed by several processes simultaneously, the consequences can be disastrous). Anti-viruses install special drivers in the system to hook into file access routines, and those hooks are queued. Thus, a well-designed system will grant anti-viruses access to the file one after another.

Important! File access hooks of this kind may enable malware to queue a hook function of its own to be executed first and thus remain undetected by all the anti-viruses. That's why Dr.Web hooks into the file access routines of the system drivers rather than the file operations being used by applications.

Indeed. This issue's author managed to run three anti-viruses on the same computer. Only the browser seemed nervous. That's why we do not recommend that you repeat this experiment.

Well, that's a bit confusing. Why would an anti-virus assume the role of a sole protector? People often use other third-party firewalls and parental control solutions as well as other security and backup tools. Does this mean that anti-viruses engage in a battle with all those programs?

Can one anti-virus regard another anti-virus's files as malware? First, there is this ancient myth about virus definitions. Because malware signatures are stored in virus databases, people believe that an anti-virus will go insane should it stumble upon another anti-virus's database and detect a huge volume of malicious code in a single file. But signatures only incorporate typical code fragments, and there is no telling which piece of code will be picked by each anti-virus developer for their detection routines. Even if we assume that all the developers in existence accidentally came up with the same signature (probability theory deals with even more incredible things), even then nothing horrendous will happen—signatures are stored in the databases in compressed formats. An anti-virus won't start decompressing someone else's database—there is no utility in that.

But every now and then media outlets report how a certain anti-virus started blocking another similar application. Yes, things like that may happen but no more often than incidents involving other legitimate applications being blocked. And sometimes an anti-virus starts removing its own files. No finger pointing here, but this is something that’s never happened to us.

However, anti-viruses do warn users that a certain application is being installed. In fact, no anti-virus can be 100 percent certain that all the applications in the system are legitimate. That's why installation alerts from the preventative protection are to be expected. And that's how the anti-virus reacts to any installation attempt, be it another anti-virus or some other software.

But suppose that one anti-virus does indeed start deleting another one. Let's forget about self-defence mechanisms for a minute since those will never let that happen. What will happen if deletion commences? Well, nothing out of the ordinary. An anti-virus is just a piece of software. It is complex, but still it is only a program. No shooting exchanges and partition formatting to cleanse the area of an opponent.

That doesn't sound logical. For example, if Dr.Web CureIt! opens a file, the installed anti-virus (as described above) is supposed to notice that and examine the file before Dr.Web gains access to it. "As a result, access to the file may get blocked". But, as people who use Dr.Web CureIt! know, nothing of the sort ever happens.

As a matter of fact, all those arguments give no information about protection technologies. They focus on possible issues—something that can actually be avoided if well-tested products are being used.

But does this mean that security standards are based on sound reasoning and two anti-viruses can indeed be installed on the same computer? And this is not quite true either. The rationale behind the idea about anti-viruses being used concurrently is based on the premise that different anti-virus developers may receive different malware samples and should one anti-virus miss a certain trojan, the other one will surely detect it. But, in reality, it's not that simple. Virus makers test their malware against all known anti-viruses before their trojans are unleashed into the wild. And no matter how many anti-virus databases are being used in your system, multiple anti-virus scans won't protect you against a well-orchestrated attack. There are other technologies that can indeed enhance overall security (e.g., the behaviour analyser).

#anti-virus_scan #security #Dr.Web_CureIt!