Antivirus Software Overview
Antivirus software has evolved significantly in the last 20 years
At a basic level, most antivirus software runs on an endpoint machine.
Local users can interact with the software to run
“on-demand” scans against files on the machine.
Additionally, most products offer “real-time scanning”,
which scans a file when it is downloaded or an attempt is made to execute it.
In either case, if a malicious file is detected,
it is either deleted or quarantined.
Most detection software is signature-based.
Antivirus vendors use automated processes and manual reverse-engineering efforts
to create these signatures, which are stored in massive databases.
While signature algorithms are often close-held secrets,
most rely on MD5 or SHA-1 hashes of malicious files
or on unique byte sequences discovered in known malicious files.
If a scanned file matches a known hash,
or contains a malicious byte sequence, it is flagged as malicious.
In addition to signature scanning, some software performs heuristics
or behavioral analysis that simulates execution of a scanned file.
Most implementations execute the scanned file in a sandboxed environment,
attempting to detect known malicious behavior.
The success rate of this approach varies widely from vendor to vendor.
In this module, we’ll primarily target the free-to-use ClamAV
and Avira antivirus products.
Although these products do not offer top-tier detection rates,
they do employ signature and heuristic detection
We will also use online resources to verify our bypass techniques
against other antivirus products