AV works usually after main virus spreading because definitions are upgraded in quite significant intervals contrary to purely automatic virus infections. I found most AVs more effective in looking for politically-incorrect programs than real viruses. They're detected as "generic malware" usually.
A few examples:
- My own program in WinAPI to run another program with clock's date changed back for a very short moment (typical behavior of crack, this time I cracked TIP with a full blessing of manufacturer ).
- Original driver for keypad (this is quite wtf, but it works in all its versions).
- Package for programming in ladder logic for an old system, obsolete according to manufacturer - I wonder how much money AV companies got to classify it as virus and make people buy a new drivers/software...
- A few EXE patches and updates of my make to modify resources in existing programs.
I think it's better to have some good network firewall and process monitor which asks about what a new process starts to do.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.