Anti-virus software losing fight against viruses
Software engineers are losing the war against fast-spreading viruses, according to a study of anti-virus programmes.india Updated: Dec 10, 2003 22:23 IST
Software engineers are losing the war against fast-spreading viruses of the kind that have disabled hundreds of thousands of computers this year, according to the first study into the effectiveness of anti-virus programmes.
Antivirus software, and the means used to distribute it, simply cannot cope with the blitzkrieg war waged by a new rapidly replicating virus or "worm," according to Matthew Williamson, a researcher with computer giant Hewlett-Packard.
Williamson, whose research is reported on Saturday in the British weekly New Scientist, designed a computer model to mimic the way in which viruses spread around the world.
He then emulated the typical response of antivirus software to a new virus.
The antivirus defences were far too slow at detecting the invader, at formulating a "patch" that shields a computer against it, and at distributing the "patch" to clients, he found.
Eventually, the antiviral software did gain the upper hand and stopped the virus from spreading but by that time, the damage was already done.
Williamson says his tests prove that the fundamental strategy for fighting fast viruses is flawed.
"These fast viruses are what we are getting at the moment," he told New Scientist, referring to the Slammer, MSBlaster and SoBig viruses this year that infected tens of thousands of machines within hours of being launched.
The next generation of fast viruses will be even more rapid, New Scientist says.
One called Flash Worm could infect an entire PC network within 15 seconds, while a type called the Warhol Worm could spread worldwide within just 15 minutes.
Most anti-virus software works by spotting telltale patterns in computer codes that point to a virus.
Once this "signature" has been identified, the company then distributes a patch to everyone who has bought antivirus software. The software then blocks or eradicates code which bears the signature.
First Published: Dec 01, 2003 12:45 IST