The function principle of virus detection software

Computer virus detection software, usually from two aspects, effective detection of toxic files.

1. Closely monitor memory Ram area

The monitoring of RAM mainly includes three aspects:

(1) Tracking abnormal changes in memory capacity

The memory capacity is represented by a word cell at the memory 0000:004bh. Normally, a word at this point represents the amount of memory in K. For example, if the memory capacity is 512K, the word's memory is 0200H, and if the memory capacity is 640K, the word content is 0280H. Since the system virus is invading the system, it is generally necessary to modify the memory capacity, so as to protect its high end of memory virus program is not covered by other programs or the temporary part of the Command.com file.

Therefore, if the software detects some unusual changes in memory capacity, usually the capacity is arbitrarily occupied, a large scale, it indicates that there is a virus.

(2) To monitor and detect interrupt vectors

This principle is the same as the part about virus alarm software.

(3) scanning the Ram area

All the strings in the Ram area are scanned using a large number of virus eigenvalues stored in the detection software. If you find that some of the strings in RAM are the same as the eigenvalue strings of known viruses, then you should take immediate action to indicate that the virus resides in memory.

2. Monitor disk boot Sector

The system virus mainly maintains the boot sector, and the guidance sector is strictly monitored, which can effectively detect the system virus.

(1) Code and changes, there may be a virus infection.

After all versions of DOS are formatted, the contents of the disk boot sector are fixed, so the code is fixed. Detection software after the code and, if found that its results and DOS version of the normal code inconsistent, you can initially determine the detected disk boot sector is infected with the virus.

This approach has its limitations, and it usually needs to be combined with other methods to make a final judgment.

(2) Scan all strings of boot sector

If a virus eigenvalue string appears, it can be determined that the virus exists in the boot sector.

(3) Full scan of disk files

The detection software scans all files in the system to find the virus eigenvalue string to determine if any viruses have been detected.

Obviously, it is a way of acting against a file-type virus.