Company:Kaspersky Lab

Kaspersky Lab

Kaspersky Virus Lab (September 18, 2014)
Native name	Лаборатория Касперского
Romanized name	Laboratoriya Kasperskogo
Type	Private
Industry	Computer software
Founded	Moscow, Russia (1997 (1997))
Founders	Eugene Kaspersky Natalya Kaspersky Alexey De-Monderik Vadim Bogdanov
Headquarters	Moscow, Russia Regional units: Dubai, UAE; Istanbul, Turkey; Mexico City, Mexico; Midrand, South Africa; São Paulo, Brazil; Singapore
Area served	Worldwide
Key people	Eugene Kaspersky (CEO)
Products	Cybersecurity software
Services	Computer security
Revenue	US$822 million (2024)
Number of employees	4,000+ (2020)
Website	www.kaspersky.com

Kaspersky Lab (/kæˈspɜːrski/; Russian: Лаборатория Касперского, romanized: Laboratoriya Kasperskogo) is a Russian multinational cybersecurity and anti-virus provider company, which is headquartered in Moscow, Russia, and operated by a holding company in the United Kingdom until it closed in 2024. It was founded in 1997 by Eugene Kaspersky, Natalya Kaspersky and Alexey De-Monderik. Kaspersky Lab develops and sells antivirus, endpoint security, SIEM, XDR, and other cybersecurity products and services. The Kaspersky Global Research and Analysis Team (GReAT) has led the discovery of sophisticated espionage platforms conducted by nations, such as Equation Group and the Stuxnet worm. Their research has uncovered large-scale and highly technical cyber espionage attempts. Kaspersky also publishes the annual Global IT Security Risks Survey.

Kaspersky expanded abroad from 2005 to 2010 and grew to $822 million in annual revenues by 2024. In 2010, Kaspersky Lab ranked fourth in the global ranking of antivirus vendors by revenue. It was the first Russian company to be included into the rating of the world's leading software companies, called the Software Top 100 (79th on the list, as of June 29, 2012). In 2016, Kaspersky's research hubs analyzed more than 350,000 malware samples per day. In 2016, the software had about 400 million users and was one the largest market-share of cybersecurity software vendors in Europe.

The US government has alleged that Kaspersky has engaged with the Russian Federal Security Service (FSB)—ties which the company has actively denied. In 2017, the Trump administration issued a ban of Kaspersky software on federal civilian and military computers. In response to these and other allegations, Kaspersky began to solicit independent reviews and verification of its source code, and relocated core infrastructure and customer data from Russia to Switzerland. Multiple countries have banned or restricted their government agencies from using Kaspersky products, including Lithuania, the Netherlands, and the United States.

As of 2025, Kaspersky has over 30 offices in Europe, Middle East, Africa, Asia, and Latin America, and customers in over 200 countries.

History

The first version of Kaspersky Lab's antivirus software was developed by Eugene Kaspersky in 1989 in response to the Cascade Virus. Early versions had just 40 virus definitions and were mostly distributed to friends and family members. Kaspersky continued developing the software at KAMI, resulting in the AntiViral Toolkit Pro (AVP) product released in 1992. It was popularized in 1994 after a competitive analysis by Hamburg University gave his software first place.

In 1997, Eugene Kaspersky, his wife Natalya Kaspersky, and Alexey De-Monderik left KAMI to form Kaspersky Lab, and to continue developing the antivirus product, then called AVP. The product was renamed Kaspersky Anti-Virus after an American company registered the AVP trademark in the US.

In 1998, a Taiwanese student released a virus called CIH. During the first three weeks of the outbreak, Kaspersky Lab's AVP was the only software at the time able to remove it. This increased demand and led to deals with antivirus companies in Japan, Finland and Germany to integrate AVP into their software.

According to WIRED, Kaspersky's software was "advanced for the time". For example, it was the first software to monitor viruses in an isolated quarantine. The company's revenue grew 280 percent from 1998 to 2000, with about 60 percent of its revenue coming from foreign sales. Natalya worked to broker deals abroad and localize the software. It opened offices in the UK, Poland, Holland and China. It later expanded to Germany, France, the US and Japan. By 2000, the company had 65 employees and sales in more than 40 countries. Kaspersky opened new offices in South East Asia and the Middle East in 2008 and in South Africa in 2009. It also expanded in India, the Middle East and Africa in 2010. In 2009, retail sales of Kaspersky Lab's antivirus products reached almost 4.5 million copies per year.

In 2011, General Atlantic bought a 20 percent share of Kaspersky Lab for $200 million, with the expectation of helping the company go public. A few months later, the decision was made to keep the firm private and Kaspersky re-purchased the shares from General Atlantic. This was followed by numerous executive departures in 2011 and 2014 regarding disputes over going public and over Eugene Kaspersky's management style.

On January 1, 2012, Kaspersky Lab officially left the Business Software Alliance (BSA) over SOPA. The BSA had supported the controversial anti-piracy bill, but Kaspersky Lab did not support it stating, "we believe that such measures will be used contrary to the modern advances in technology and the needs of consumers," and to show their disapproval, announced their intent to leave on December 5, 2011.

By 2013, the company had an unaudited $667 million in annual revenues. In 2014, Kaspersky Lab signed a distribution deal with Ingram Micro, which significantly expanded its reseller program.

In August 2015, two former Kaspersky employees alleged that the company introduced modified files into the VirusTotal antivirus database to trick software from Kaspersky competitors into triggering false positives in virus and malware scans. A possible motive is that Eugene Kaspersky allegedly was furious at competitors perceived to be "unfairly" free-riding on Kaspersky's malware discoveries via the open-source VirusTotal database. The company denied the allegations. On his personal blog, Eugene Kaspersky compared the accusations to unsubstantiated conspiracy theories. Reuters followed up by publishing leaked emails allegedly from Kaspersky alluding to "falsies" and "rubbing out" foreign competitors; Kaspersky Lab stated the emails "may not be legitimate and were obtained from anonymous sources that have a hidden agenda".

In 2016, Kaspersky executive Ruslan Stoyanov was arrested by Russian authorities on charges predating his work at Kaspersky. In 2019, he was convicted of treason.

In June 2023, Kaspersky Lab said many of its senior staff and managers were hit by an ongoing attack that it first suspected in early 2023 and has compromised thousands of iPhones. The oldest traces of infection date back to 2019. The Russian Federal Security Service (FSB) separately accused the US National Security Agency and company Apple of being behind the attack and infiltrating the phones of diplomats from China, Israel, NATO members, and Syria. Kaspersky Lab said it does not believe itself to be the main target and that it had not shared its own findings about the attack with Russian authorities until the FSB announcement.

On 20 June 2024, after the US announced that it would prohibit Kaspersky from selling or distributing updates to its software to US customers and sanctioned 12 of its senior leaders, the company announced it would leave the US market. On September 25, the company abruptly replaced its software on US users' computers with UltraAV software developed by US cybersecurity firm Pango, angering some users.

Products and services

See also: Software:Kaspersky Anti-Virus and Kaspersky Internet Security

Home screen of Kaspersky Internet Security

Kaspersky Lab develops and markets antivirus, internet security, password management, endpoint security, and other cybersecurity products and services. It is the fourth or fifth largest endpoint security vendor and the third largest consumer IT security software company. It is the sixth largest overall IT security company. Its revenues are about 15 percent from Russian companies domestically, one-third from European organizations and one-fourth from US organizations. The software has about 400 million users in all.

Kaspersky's consumer software include the Antivirus, Internet Security and Total Security products. The Antivirus software includes malware protection, monitors the PC for suspicious program behavior, and warns users about potentially dangerous websites. The Internet Security software adds privacy features, parental controls, anti-phishing tools. Total Security adds parental controls, adult website filters, diagnostic tools, a Password Manager application, and other features. Since 2023, the new lineup was introduced, with Kaspersky Basic, Plus and Premium replacing Antivirus, Internet Security and Total Security. Kaspersky's software is available for Macs, PCs, Android, iOS, Windows Mobile, BlackBerry and Symbian.

For businesses, the company has developed Kaspersky Industrial CyberSecurity for OT environments, and Kaspersky Hybrid Cloud Security for container infrastructures. Detection and response solutions include Kaspersky Next XDR Expert, Kaspersky Next EDR Optimum, and Kaspersky SIEM for centralized security monitoring. The company markets the Kaspersky Endpoint Security for Business suite. It includes a centralized user interface and management application called the Kaspersky Security Center. The cybersecurity software itself is called the Kaspersky Security Network. The Kaspersky Administration KitSecurity Center manages configuration, installation and remote use. The business suite also has quarantine, reporting, and other features. Its software product for businesses with 25 staff or less is called Kaspersky Small Office Security (KSOS). Within the suite are products specifically for virtualization security, mobile security, and fraud protection among others. Kaspersky also develops a free tool that helps businesses gain access to Windows devices that are infected by ransomware. In 2017, KasperskyOS, a secure operating system, was released, and in 2021, Kaspersky IoT Secure Gateway 100 for IoT was introduced based on it. Among cloud solutions, Kaspersky Hybrid Cloud Security protects cloud infrastructures, and Kaspersky SD-WAN ensures secure corporate networks.

KasperskyOS

KasperskyOS is a proprietary microkernel operating system built from scratch using secure-by-design principles. It's developed by Kaspersky for embedded and industrial devices with heightened cybersecurity demands. It features minimal trusted kernel, strict isolation of components in user space, default-deny policy enforcement and formal, policy-based control via the Kaspersky Security System. The aim is to create “Cyber Immune” systems that keep critical functions operating even if some parts of the system are attacked via unknown vulnerabilities. Key use cases are network equipment, industrial control/IoT gateways, smart cars, smart city and transport infrastructure, and other critical-infrastructure uses.

KasperskyOS is distributed both as a platform and inside finished appliances such as the Kaspersky IoT Secure Gateway (KISG 100/1000), while early deployments also appeared in Kraftway routing/switching gear.

There is a community edition for prototyping and development.

Threatpost

Threatpost is a discontinued computer security blog which was funded by Kaspersky Lab. According to Eugene Kaspersky, it was independent of Kaspersky. It was launched in 2009. After August 2022, no new articles have been published on the site.

Partnerships

The Kaspersky Anti-Virus engine also powers products or solutions by other security vendors, such as Check Point, Bluecoat, Juniper Networks, Microsoft Forefront, Netintelligence, Clearswift, FrontBridge, Netasq, Wedge Networks, and others. Altogether, more than 120 companies are licensing technology from Kaspersky Lab. Kaspersky Lab also has a number of partnerships with various technology companies.

The International Multilateral Partnership Against Cyber Threats in which Datuk Mohd Noor Amin acts as the chairman, announced the appointment of Harry Cheung – Managing Director of Kaspersky Lab, APAC – as the Goodwill Ambassador for Greater China.

Kaspersky Lab was a long-term partner of Scuderia Ferrari and in December 2021, announced a partnership extension with the Formula One team, and also became the team's esports partner. However, in March 2022 the deal was paused as a joint decision taken by the two companies due to the 2022 Russian invasion of Ukraine.

In 2024, Kaspersky and the African Union’s law enforcement agency, AFRIPOL, signed a five-year cooperation agreement to prevent and combat cybercrime.

Interpol

INTERPOL and Kaspersky have maintained a long-standing partnership aimed at preventing and combating cybercrime worldwide. In 2013, Kaspersky supported INTERPOL’s Global Complex for Innovation in Singapore by providing advanced digital forensics tools and expertise to aid international investigations.

In 2016, the two organizations signed a cyber threat intelligence exchange agreement to enhance real-time data sharing on emerging threats. This cooperation was renewed and expanded in 2019, enabling joint operations targeting major malware campaigns and organized cybercrime groups.

During the 2024 Summer Olympics in Paris, Kaspersky supported INTERPOL in countering cyberattacks aimed at the Games’ infrastructure and participants. In 2025, their joint efforts helped dismantle over 20,000 malicious IP addresses and domains linked to information-stealing malware, as part of a global crackdown involving law enforcement from more than 50 countries.

The partnership focuses on sharing threat intelligence and strengthening global cybersecurity resilience.

Market assessments and reception

According to 2016 reviews in PC Magazine, Kaspersky AntiVirus and competitor Bitdefender were both consistently ranked at the top in independent competitive tests. PC Magazine's own malware and phishing tests showed similar results. Noted pros — “bonus security tools” and a large number of Kaspersky Total Security features, including password management, encryption and parental control software. Minuses — scanning took longer than expected. The product received high scores in lab tests for antivirus, antiphishing and other features and “average” scores in tests for antivirus and spam filtering.

Kaspersky's 2013 Endpoint Security for Windows product was the top-ranked enterprise antivirus software in a competitive test by Dennis Technology Labs, followed by Symantec Endpoint Protection. AV-Comparatives awarded Kaspersky "Product of the Year" for 2015, based on the number of high scores it received throughout the year on a wide range of tests. PC Magazine praised the software's features, but said it lacked policy management and deployment options. Kaspersky's parental control software has been praised by PC Magazine for its “very affordable parental control and monitoring,” software content filtering, child profiles, social media monitoring and other features. Downsides noted: some features only available for iOS or Android.

The anti-virus software testing group AV-Comparatives gave the Windows XP version of Kaspersky AV an "Advanced+" rating (its highest) in both its February 2008 on-demand detection test (with the fourth highest detection rate among 16 products tested). However, in the Retrospective/Proactive Test May 2008, Kaspersky received the "Standard" rating, detecting 21% of new malware with 1-month old signatures and receiving a substantial amount of false positives.

The firewall included in Kaspersky Internet Security 7.0 got a "Very Good" rating in Matousec's Firewall challenge, with a result of 85%. Kaspersky Anti-Virus 7.0 has achieved a 6.5 result out of 8 in the Anti Malware Labs rootkit detection test. It has also achieved a 31 out of 33 detection of polymorphic viruses and a 97% result in the self-protection test. In 2007, Kaspersky Internet Security 7 received an award from the British magazine PC Pro and also won a place in its "A List".

Kaspersky has passed most of the Virus Bulletin comparative tests since August 2003. In 2005, according to PC World magazine, Kaspersky anti-virus software provided the fastest updates for new virus and security threats in the industry.

In PC World magazine's March 2010 comparison of consumer security suites, Kaspersky Internet Security 2010 scored 4.5/5 stars, and was rated second overall. In the December 2011 version of AV-Comparatives' annual reports, Kaspersky Lab's software achieved the highest overall ranking and has earned the AV Comparatives' "Product of the Year" award.

On February 1, 2012, Kaspersky Internet Security earned "AV-TEST Award for Best Repair 2011" award in the field of home user products from AV-TEST Institute. On January 28, 2013, Kaspersky Endpoint Security earned "AV-TEST Award for Best Protection 2012" and "AV-TEST Award for Best Repair 2012" awards in the field of corporate products from AV-TEST Institute.

Later in 2013, Kaspersky earned the product of the year award from AV-Comparatives and the highest score among Enterprise solutions in a Dennis Technology Labs report.

Kaspersky has also received certification of its products through the OESIS OK Certification Program, which verifies that the applications are interoperable with third-party technology solutions like NAC and SSL VPN products from Cisco Systems, Juniper Networks, F5 Networks, and others.

Kaspersky products regularly participate in and achieve high results in independent tests by AV-Test, AV-Comparatives, and SE Labs. These organizations are members of the Anti-Malware Testing Standards Organization (AMTSO), which Microsoft has adopted as an “industry standard organization” for independent certification purposes.

Finances

Year	Revenue in million US$	Growth / Decrease	Development rate
2012	628	Template:Growth	3 %
2013	667	Template:Growth	6 %
2014	711	Template:Growth	6,6 %
2015	619		13 %
2016	644	Template:Growth	4 %
2017	698	Template:Growth	8 %
2018	726	Template:Growth	4 %
2019	685		6 %
2020	703,9	Template:Growth	3 %
2021	752,3	Template:Growth	6,8 %
2022	752,5	Template:Growth	0,03 %
2023	721		4,1 %
2024	822	Template:Growth	14 %

Malware discovery

Kaspersky Lab's Global Research and Analysis Team (GReAT) was established in 2008. It investigates cybersecurity threats and other work by malware operations. IT security companies are often evaluated by their ability to uncover previously unknown viruses and vulnerabilities. Kaspersky's reputation for investigating cyber-security threats has been influential in gaining sales and prestige. Beginning around 2010, Kaspersky exposed a series of government-sponsored cyber-espionage and sabotage efforts. These include Stuxnet, Duqu, Flame, Gauss, Regin and the Equation Group. According to Wired, "many of them [were] seemingly launched by the US and its UK and Israeli allies. Kaspersky is especially well-known for its work uncovering Stuxnet, Careto, and Flame."

Stuxnet

Main article: Engineering:Stuxnet

In 2010, Kaspersky Lab worked with Microsoft to counteract the Stuxnet worm, which had infected 14 industrial locations in Iran using four zero-day vulnerabilities in Microsoft Windows. According to IEEE Spectrum, the circumstances "strongly suggest" the worm was developed by the United States and Israel to damage centrifuges in Iran's nuclear-enrichment program. It was the first discovery of a major government-sponsored cyber-attack.

Flame

Main article: Flame (malware)

In May 2012, Kaspersky Lab identified the malware Flame, which a researcher described as potentially "the most sophisticated cyber weapon yet unleashed". According to the researchers in Kaspersky Lab, the malware had infected an estimated 1,000 to 5,000 machines worldwide when asked by the United Nations International Telecommunication Union to investigate reports of a virus affecting Iranian Oil Ministry computers. As Kaspersky Lab investigated, they discovered an MD5 hash and filename that appeared only on customer machines from Middle Eastern nations. After discovering more pieces, researchers dubbed the program "Flame" after the name of one of its modules.

Flame was an earlier variant of Stuxnet. Kaspersky never verified the source of the software, but it is suspected to have been developed by the National Security Agency (NSA) to transmit keystrokes, Skype calls and other data. Kaspersky created algorithms to find similar malware and found Gauss that July, which collected and transmitted data from devices infected by bluetooth or USB drives.

Red October

Main article: Red October (malware)

In January 2013, Kaspersky discovered the Red October malware, which had been used for widespread cyber-espionage for five years. It targeted political targets like embassies, nuclear sites, mostly in Europe, Switzerland and North America. The malware was likely written by Russian-speaking hackers and the exploits by Chinese hackers. That June, Kaspersky discovered NetTraveler, which it said was obtaining data on emerging technology from government targets and oil companies. Kaspersky did not identify who was behind it, but it was similar to other cyber-espionage coming from Beijing, China. Later that same year, Kaspersky discovered a hacker group it called Icefog after investigating a cybersecurity attack on a Japanese television company. Kaspersky said the hacker group, possibly from China, was unique in that they targeted specific files they seemed to know about before planting malware to extract them.

Mask

In February 2014, Kaspersky identified the malware Mask, which infected 380 organizations in 31 countries. Many organizations that were affected were in Morocco. Some of the files were in Spanish and the group is believed to be a state conducting espionage, but Kaspersky did not speculate on which country may have developed it.

Regin

Main article: Regin (malware)

In November 2014, Symantec and Kaspersky authored papers that contained the first disclosure of malicious software named Regin. According to Kaspersky, Regin is similar to QWERTY, a malware program discovered the next year. Regin was used to take remote control of a computer and is believed to have originated from the Five Eyes alliance. That same month Kaspersky reported on the Darkhotel attack, which targeted users of wireless networks at hotels in Asia. It asked users to update their software, and then download malware that gave up their passwords.

Equation Group

In 2015, Kaspersky identified a highly sophisticated threat actor that it called "The Equation Group". The group incorporated sophisticated spying software into the firmware of hard drives at banks, government agencies, nuclear researchers and military facilities, in countries that are frequent targets of US intelligence efforts. It is suspected to have been developed by the National Security Agency (NSA) and included many unique technical achievements to better avoid detection. That same day, Kaspersky announced the discovery of a hacker group it called Carbanak, which was targeting banks and moving millions of dollars into fake accounts. Carbanak was discovered when one bank asked Kaspersky to investigate suspicious behavior from its ATMs. A similar malware using some of the same techniques as Carbanak was discovered in 2016 and dubbed Carbanak 2.0.

Duqu

Main article: Duqu

In June 2015, Kaspersky reported that its own network had been infiltrated by government-sponsored malware. Evidence suggested the malware was created by the same developers as Duqu and Stuxnet, in order to get intelligence that would help them better avoid detection by Kaspersky in the future. Kaspersky called it Duqu 2.0. The malicious software resided in memory to avoid detection. The hack was believed to have been done by the same group that did Duqu in 2011. It used exploits in Microsoft installer files.

Android cyber-espionage

Main article: Company:Hacking Team

In June 2015, Kaspersky Lab and Citizen Lab both independently discovered software developed by Hacking Team and used by 60 governments around the world to covertly record data from the mobile phones of their citizens. The software gave police enforcement a "menu of features" to access emails, text messages, keystrokes, call history and other data. Kaspersky also identified 37,000 attacks against banking companies that used modifications of the malware called Asacub and took control of Android devices. Asacub targeted mostly banking customers in the US, Russia and Ukraine using an SMS message that baited users into installing a Trojan.

Silverlight

In 2016, Kaspersky discovered a zero day vulnerability in Microsoft Silverlight. Kaspersky identified a string of code often used by exploits created by the suspected author. It then used YARA rules on its network of Kaspersky software users to find that string of code and uncover the rest of the exploit. Afterwards, Microsoft issued a "critical" software patch to protect its software from the vulnerability.

Poseidon Group

In 2016, Kaspersky uncovered the Poseidon Group, which would infiltrate corporations with malware using phishing emails, then get hired by the same company as a security firm to correct the problem. Once hired, Poseidon would install additional malware and backdoors. In June 2016 Kaspersky helped uncover a Russian hacking group, leading to 50 arrests.

Titanium

In 2019, Kaspersky uncovered Titanium, a very advanced and insidious backdoor malware APT, developed by PLATINUM, a cybercrime collective. Kaspersky Lab reported the malware on November 8, 2019.

MATA Toolset Campaign

In 2020, Kaspersky published research on the MATA Toolset Campaign, a sophisticated cyber-espionage framework targeting multiple operating systems, including Windows, macOS, and Linux. The malware, attributed to the Lazarus Group, was used for stealing databases, distributing ransomware, and installing backdoors on infected systems. MATA's capabilities allowed attackers to execute a wide range of malicious activities, including exfiltrating sensitive data from corporate networks and compromising financial systems. The campaign highlighted the increasing cross-platform threat posed by state-sponsored actors. In September 2022 and October 2023, new malware samples linked to the MATA cluster were uncovered.

PyPI Supply Chain Attack

In 2024, Kaspersky uncovered a year-long supply chain attack targeting the Python Package Index (PyPI), a popular repository for Python developers. Attackers uploaded malicious packages containing JarkaStealer, a malware designed to exfiltrate sensitive information from infected systems. These packages were disguised as legitimate tools and lured victims through social engineering tactics, including AI (OpenAI's ChatGPT) chatbots offering assistance. The campaign demonstrated the vulnerability of open-source ecosystems and emphasized the importance of scrutinizing dependencies in software development.

NKAbuse Malware

In 2023, Kaspersky exposed NKAbuse, a sophisticated multiplatform malware written in the Go programming language. This malware leveraged blockchain technology for its peer-to-peer communication infrastructure, making it resilient to takedowns. NKAbuse functioned as a flooder and a backdoor, enabling attackers to launch distributed denial-of-service (DDoS) attacks and gain persistent access to compromised systems. The campaign illustrated the evolving use of blockchain in cybercrime and reinforced the need for enhanced detection methods.

Triangulation

Main article: Operation Triangulation

In 2023, Kaspersky uncovered Triangulation, a sophisticated spyware campaign targeting iOS mobile devices. The malware exploited multiple zero-day vulnerabilities to gain full control of targeted devices. Triangulation was primarily distributed through malicious attachments in instant messaging apps. Once installed, it allowed attackers to access encrypted communications, GPS locations, and sensitive data. Kaspersky attributed the campaign to an advanced persistent threat (APT) group but refrained from naming a specific actor, though evidence suggested ties to state-sponsored espionage.

CloudSorcerer/EastWind

CloudSorcerer APT and its EastWind campaign were identified by Kaspersky in 2024.The malware leveraged public cloud infrastructure to perform large-scale data exfiltration and surveillance. The attackers used sophisticated phishing campaigns to infiltrate government and private sector organizations, especially targeting research institutions and critical infrastructure. CloudSorcerer employed novel encryption techniques to disguise data flows, complicating detection. Kaspersky linked the malware to a state-affiliated group but did not specify which country was behind the attack.

DuneQuixote

In 2024, Kaspersky exposed DuneQuixote, a stealthy malware campaign targeting intellectual property in the technology and energy sectors. The malware used custom-built exploits and employed fileless techniques, operating entirely in memory to evade detection by traditional security tools. DuneQuixote's attack vector included compromised software updates and supply chain vulnerabilities. Kaspersky attributed the operation to a well-funded APT group with global reach, though the precise origin remained unclear. The discovery highlighted the growing complexity of threats targeting high-value intellectual assets.

SparkCat

In February 2025 discovers SparkCat, a first OCR infostealer found in iOS App Store. On iOS and Android, infostealer requests access to users' photo galleries when they attempt to use support chat in an infected app. Once granted permission, the malware uses Google's OCR technology to decipher text in photos and looks for screenshots of passwords or phrases to regain access to cryptocurrency, then sends them to the attacker. By February 10, 2025, Apple and Google had removed about 20 apps from their app stores, but the malware remained available in unofficial stores and websites.

Bans and allegations of Russian government ties

Since 2015, Western media outlets and governments have accused Kaspersky of having close ties to the Russian government. In 2017, allegations emerged that hackers had used Kaspersky software to steal confidential data from the home computer of a contractor for the US National Security Agency (NSA). Kaspersky denied the allegations, reporting that the software had detected Equation Group malware samples which it uploaded to its servers for analysis in its normal course of operation.

In September 2017, the US Department of Homeland Security banned federal agencies from using and purchasing Kaspersky software, requiring them to remove it from their systems within 90 days. In December, President Donald Trump signed the National Defense Authorization Act for Fiscal Year 2018, which extended this ban to military computers. In response, the company launched a “Global Transparency Initiative”, moving its infrastructure to process customer data to Switzerland and opening transparency centers in a number of countries to allow customers and regulators to review its source code and data processing practices.

In 2022, following Russian invasion of Ukraine, the US warned companies about the risks of using Kaspersky software, and the FCC added it to its list of national security threats. In response, the company said the decision was political and expressed its willingness to cooperate with the authorities to address their concerns. In 2024, leaked emails showed that Kaspersky allegedly helped Russia develop software for spy drones.

In April 2024, it became known that the US Department of Commerce was considering a complete ban on the sale of Kaspersky products. On June 20, Secretary of Commerce Gina Raimondo announced that sales would be banned in the US from July 20 and software updates from September 29, as part of Trump and Biden's executive orders on protecting data from “foreign adversaries.” In July, the company announced the closure of its US office and the dismissal of its staff, and on July 17, it offered US customers six months of free updates, warning of limited functionality after September 29.

In February 2025, Australia banned the use of Kaspersky software in government agencies due to national security concerns. The Department of Home Affairs ordered its removal from government devices by April 1, bringing the country into line with other members of the Five Eyes intelligence pact — the US, Canada, and the UK.

See also

• Antivirus software
• Comparison of antivirus software
• Titanium (malware)
• Shaltai Boltai
• Vault 7

External links

• Official website
• Cyber Threat Real-Time Map
• Log of cybersecurity discoveries

Short description: Computer software to defend against malicious computer viruses

ClamTk, an open-source antivirus based on the ClamAV antivirus engine, was originally developed by Tomasz Kojm in 2001.

Antivirus software (abbreviated to AV software), also known as anti-malware, is a computer program used to prevent, detect, and remove malware.

Antivirus software was originally developed to detect and remove computer viruses, hence the name. However, with the proliferation of other malware, antivirus software started to protect against other computer threats. Some products also include protection from malicious URLs, spam, and phishing.

History

1949–1980 period (pre-antivirus days)

Although the roots of the computer virus date back as early as 1949, when the Hungarian scientist John von Neumann published the "Theory of self-reproducing automata", the first known computer virus appeared in 1971 and was dubbed the "Creeper virus". This computer virus infected Digital Equipment Corporation's (DEC) PDP-10 mainframe computers running the TENEX operating system.

The Creeper virus was eventually deleted by a program created by Ray Tomlinson and known as "The Reaper". Some people consider "The Reaper" the first antivirus software ever written – it may be the case, but it is important to note that the Reaper was actually a virus itself specifically designed to remove the Creeper virus.

The Creeper virus was followed by several other viruses. The first known that appeared "in the wild" was "Elk Cloner", in 1981, which infected Apple II computers.

In 1983, the term "computer virus" was coined by Fred Cohen in one of the first ever published academic papers on computer viruses. Cohen used the term "computer virus" to describe programs that: "affect other computer programs by modifying them in such a way as to include a (possibly evolved) copy of itself." (note that a more recent definition of computer virus has been given by the Hungarian security researcher Péter Szőr: "a code that recursively replicates a possibly evolved copy of itself").

The first IBM PC compatible "in the wild" computer virus, and one of the first real widespread infections, was "Brain" in 1986. From then, the number of viruses has grown exponentially. Most of the computer viruses written in the early and mid-1980s were limited to self-reproduction and had no specific damage routine built into the code. That changed when more and more programmers became acquainted with computer virus programming and created viruses that manipulated or even destroyed data on infected computers.

Before internet connectivity was widespread, computer viruses were typically spread by infected floppy disks. Antivirus software came into use, but was updated relatively infrequently. During this time, virus checkers essentially had to check executable files and the boot sectors of floppy disks and hard disks. However, as internet usage became common, viruses began to spread online.

1980–1990 period (early days)

There are competing claims for the innovator of the first antivirus product. Possibly, the first publicly documented removal of an "in the wild" computer virus (i.e. the "Vienna virus") was performed by Bernd Fix in 1987.

In 1987, Andreas Lüning and Kai Figge, who founded G Data Software in 1985, released their first antivirus product for the Atari ST platform. In 1987, the Ultimate Virus Killer (UVK) was also released. This was the de facto industry standard virus killer for the Atari ST and Atari Falcon, the last version of which (version 9.0) was released in April 2004. In 1987, in the United States, John McAfee founded the McAfee company (was part of Intel Security) and, at the end of that year, he released the first version of VirusScan. Also in 1987 (in Czechoslovakia), Peter Paško, Rudolf Hrubý, and Miroslav Trnka created the first version of NOD antivirus.

In 1987, Fred Cohen wrote that there is no algorithm that can perfectly detect all possible computer viruses.

Finally, at the end of 1987, the first two heuristic antivirus utilities were released: Flushot Plus by Ross Greenberg and Anti4us by Erwin Lanting. In his O'Reilly book, Malicious Mobile Code: Virus Protection for Windows, Roger Grimes described Flushot Plus as "the first holistic program to fight malicious mobile code (MMC)."

However, the kind of heuristic used by early AV engines was totally different from those used today. The first product with a heuristic engine resembling modern ones was F-PROT in 1991. Early heuristic engines were based on dividing the binary into different sections: data section, code section (in a legitimate binary, it usually starts always from the same location). Indeed, the initial viruses re-organized the layout of the sections, or overrode the initial portion of a section in order to jump to the very end of the file where malicious code was located—only going back to resume execution of the original code. This was a very specific pattern, not used at the time by any legitimate software, which represented an elegant heuristic to catch suspicious code. Other kinds of more advanced heuristics were later added, such as suspicious section names, incorrect header size, regular expressions, and partial pattern in-memory matching.

In 1988, the growth of antivirus companies continued. In Germany, Tjark Auerbach founded Avira (H+BEDV at the time) and released the first version of AntiVir (named "Luke Filewalker" at the time). In Bulgaria, Vesselin Bontchev released his first freeware antivirus program (he later joined FRISK Software). Also Frans Veldman released the first version of ThunderByte Antivirus, also known as TBAV (he sold his company to Norman Safeground in 1998). In Czechoslovakia, Pavel Baudiš and Eduard Kučera started avast! (at the time ALWIL Software) and released their first version of avast! antivirus. In June 1988, in South Korea , Ahn Cheol-Soo released its first antivirus software, called V1 (he founded AhnLab later in 1995). Finally, in autumn 1988, in the United Kingdom, Alan Solomon founded S&S International and created his Dr. Solomon's Anti-Virus Toolkit (although he launched it commercially only in 1991 – in 1998 Solomon's company was acquired by McAfee). In November 1988 a professor at the Panamerican University in Mexico City named Alejandro E. Carriles copyrighted the first antivirus software in Mexico under the name "Byte Matabichos" (Byte Bugkiller) to help solve the rampant virus infestation among students.

Also in 1988, a mailing list named VIRUS-L was started on the BITNET/EARN network where new viruses and the possibilities of detecting and eliminating viruses were discussed. Some members of this mailing list were: Alan Solomon, Eugene Kaspersky (Kaspersky Lab), Friðrik Skúlason (FRISK Software), John McAfee (McAfee), Luis Corrons (Panda Security), Mikko Hyppönen (F-Secure), Péter Szőr, Tjark Auerbach (Avira) and Vesselin Bontchev (FRISK Software).

In 1989, in Iceland, Friðrik Skúlason created the first version of F-PROT Anti-Virus (he founded FRISK Software only in 1993). Meanwhile, in the United States, Symantec (founded by Gary Hendrix in 1982) launched its first Symantec antivirus for Macintosh (SAM). SAM 2.0, released March 1990, incorporated technology allowing users to easily update SAM to intercept and eliminate new viruses, including many that didn't exist at the time of the program's release.

In the end of the 1980s, in United Kingdom, Jan Hruska and Peter Lammer founded the security firm Sophos and began producing their first antivirus and encryption products. In the same period, in Hungary, also VirusBuster was founded (which has recently being incorporated by Sophos).

1990–2000 period (emergence of the antivirus industry)

In 1990, in Spain, Mikel Urizarbarrena founded Panda Security (Panda Software at the time). In Hungary, the security researcher Péter Szőr released the first version of Pasteur antivirus. In Italy, Gianfranco Tonello created the first version of VirIT eXplorer antivirus, then founded TG Soft one year later.

In 1990, the Computer Antivirus Research Organization (CARO) was founded. In 1991, CARO released the "Virus Naming Scheme", originally written by Friðrik Skúlason and Vesselin Bontchev. Although this naming scheme is now outdated, it remains the only existing standard that most computer security companies and researchers ever attempted to adopt. CARO members includes: Alan Solomon, Costin Raiu, Dmitry Gryaznov, Eugene Kaspersky, Friðrik Skúlason, Igor Muttik, Mikko Hyppönen, Morton Swimmer, Nick FitzGerald, Padgett Peterson, Peter Ferrie, Righard Zwienenberg and Vesselin Bontchev.

In 1991, in the United States, Symantec released the first version of Norton AntiVirus. In the same year, in the Czech Republic, Jan Gritzbach and Tomáš Hofer founded AVG Technologies (Grisoft at the time), although they released the first version of their Anti-Virus Guard (AVG) only in 1992. On the other hand, in Finland , F-Secure (founded in 1988 by Petri Allas and Risto Siilasmaa – with the name of Data Fellows) released the first version of their antivirus product. F-Secure claims to be the first antivirus firm to establish a presence on the World Wide Web.

In 1991, the European Institute for Computer Antivirus Research (EICAR) was founded to further antivirus research and improve development of antivirus software.

In 1992, in Russia, Igor Danilov released the first version of SpiderWeb, which later became Dr.Web.

In 1994, AV-TEST reported that there were 28,613 unique malware samples (based on MD5) in their database.

Over time other companies were founded. In 1996, in Romania, Bitdefender was founded and released the first version of Anti-Virus eXpert (AVX). In 1997, in Russia, Eugene Kaspersky and Natalya Kaspersky co-founded security firm Kaspersky Lab.

In 1996, there was also the first "in the wild" Linux virus, known as "Staog".

In 1999, AV-TEST reported that there were 98,428 unique malware samples (based on MD5) in their database.

2000–2005 period

In 2000, Rainer Link and Howard Fuhs started the first open source antivirus engine, called OpenAntivirus Project.

In 2001, Tomasz Kojm released the first version of ClamAV, the first ever open source antivirus engine to be commercialised. In 2007, ClamAV was bought by Sourcefire, which in turn was acquired by Cisco Systems in 2013.

In 2002, in United Kingdom, Morten Lund and Theis Søndergaard co-founded the antivirus firm BullGuard.

In 2005, AV-TEST reported that there were 333,425 unique malware samples (based on MD5) in their database.

2005–2014 period

In 2007, AV-TEST reported a number of 5,490,960 new unique malware samples (based on MD5) only for that year. In 2012 and 2013, antivirus firms reported a new malware samples range from 300,000 to over 500,000 per day.

Over the years it has become necessary for antivirus software to use several different strategies (e.g. specific email and network protection or low level modules) and detection algorithms, as well as to check an increasing variety of files, rather than just executables, for several reasons:

• Powerful macros used in word processor applications, such as Microsoft Word, presented a risk. Virus writers could use the macros to write viruses embedded within documents. This meant that computers could now also be at risk from infection by opening documents with hidden attached macros.
• The possibility of embedding executable objects inside otherwise non-executable file formats can make opening those files a risk.
• Later email programs, in particular Microsoft's Outlook Express and Outlook, were vulnerable to viruses embedded in the email body itself. A user's computer could be infected by just opening or previewing a message.

In 2005, F-Secure was the first security firm that developed an Anti-Rootkit technology, called BlackLight.

Because most users are usually connected to the Internet on a continual basis, Jon Oberheide first proposed a Cloud-based antivirus design in 2008.

In February 2008 McAfee Labs added the industry-first cloud-based anti-malware functionality to VirusScan under the name Artemis. It was tested by AV-Comparatives in February 2008 and officially unveiled in August 2008 in McAfee VirusScan.

Cloud AV created problems for comparative testing of security software – part of the AV definitions was out of testers control (on constantly updated AV company servers) thus making results non-repeatable. As a result, Anti-Malware Testing Standards Organisation (AMTSO) started working on method of testing cloud products which was adopted on May 7, 2009.

In 2011, AVG introduced a similar cloud service, called Protective Cloud Technology.

2014–present: rise of next-gen, market consolidation

Following the 2013 release of the APT 1 report from Mandiant, the industry has seen a shift towards signature-less approaches to the problem capable of detecting and mitigating zero-day attacks. Numerous approaches to address these new forms of threats have appeared, including behavioral detection, artificial intelligence, machine learning, and cloud-based file detonation. According to Gartner, it is expected the rise of new entrants, such Carbon Black, Cylance and Crowdstrike will force EPP incumbents into a new phase of innovation and acquisition. One method from Bromium involves micro-virtualization to protect desktops from malicious code execution initiated by the end user. Another approach from SentinelOne and Carbon Black focuses on behavioral detection by building a full context around every process execution path in real time, while Cylance leverages an artificial intelligence model based on machine learning. Increasingly, these signature-less approaches have been defined by the media and analyst firms as "next-generation" antivirus and are seeing rapid market adoption as certified antivirus replacement technologies by firms such as Coalfire and DirectDefense. In response, traditional antivirus vendors such as Trend Micro, Symantec and Sophos have responded by incorporating "next-gen" offerings into their portfolios as analyst firms such as Forrester and Gartner have called traditional signature-based antivirus "ineffective" and "outdated".

As of Windows 8, Windows includes its own free antivirus protection under the Windows Defender brand. Despite bad detection scores in its early days, AV-Test now certifies Defender as one of its top products. While it isn't publicly known how the inclusion of antivirus software in Windows affected antivirus sales, Google search traffic for antivirus has declined significantly since 2010.

Since 2016, there has been a notable amount of consolidation in the industry. Avast purchased AVG in 2016 for $1.3 billion. Avira was acquired by Norton owner Gen Digital (then NortonLifeLock) in 2020 for $360 million. In 2021, the Avira division of Gen Digital acquired BullGuard. The BullGuard brand was discontinued in 2022 and its customers were migrated to Norton. In 2022, Gen Digital acquired Avast, effectively consolidating four major antivirus brands under one owner.

Identification methods

In 1987, Frederick B. Cohen demonstrated that the algorithm, which would be able to detect all possible viruses, can't possibly exist (like the algorithm which determines whether or not the given program halts). However, using different layers of defense, a good detection rate may be achieved.

There are several methods which antivirus engines can use to identify malware:

• Sandbox detection: a particular behavioural-based detection technique that, instead of detecting the behavioural fingerprint at run time, it executes the programs in a virtual environment, logging what actions the program performs. Depending on the actions logged which can include memory usage and network accesses, the antivirus engine can determine if the program is malicious or not. If not, then, the program is executed in the real environment. Albeit this technique has shown to be quite effective, given its heaviness and slowness, it is rarely used in end-user antivirus solutions.
• Data mining techniques: one of the latest approaches applied in malware detection. Data mining and machine learning algorithms are used to try to classify the behaviour of a file (as either malicious or benign) given a series of file features, that are extracted from the file itself.

Signature-based detection

Traditional antivirus software relies heavily upon signatures to identify malware.

Substantially, when a malware sample arrives in the hands of an antivirus firm, it is analysed by malware researchers or by dynamic analysis systems. Then, once it is determined to be a malware, a proper signature of the file is extracted and added to the signatures database of the antivirus software.

Although the signature-based approach can effectively contain malware outbreaks, malware authors have tried to stay a step ahead of such software by writing "oligomorphic", "polymorphic" and, more recently, "metamorphic" viruses, which encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match virus signatures in the dictionary.

Heuristics

Many viruses start as a single infection and through either mutation or refinements by other attackers, can grow into dozens of slightly different strains, called variants. Generic detection refers to the detection and removal of multiple threats using a single virus definition.

For example, the Vundo trojan has several family members, depending on the antivirus vendor's classification. Symantec classifies members of the Vundo family into two distinct categories, Trojan.Vundo and Trojan.Vundo.B.

While it may be advantageous to identify a specific virus, it can be quicker to detect a virus family through a generic signature or through an inexact match to an existing signature. Virus researchers find common areas that all viruses in a family share uniquely and can thus create a single generic signature. These signatures often contain non-contiguous code, using wildcard characters where differences lie. These wildcards allow the scanner to detect viruses even if they are padded with extra, meaningless code. A detection that uses this method is said to be "heuristic detection".

Rootkit detection

Main article: Rootkit

Anti-virus software can attempt to scan for rootkits. A rootkit is a type of malware designed to gain administrative-level control over a computer system without being detected. Rootkits can change how the operating system functions and in some cases can tamper with the anti-virus program and render it ineffective. Rootkits are also difficult to remove, in some cases requiring a complete re-installation of the operating system.

Real-time protection

Real-time protection, on-access scanning, background guard, resident shield, autoprotect, and other synonyms refer to the automatic protection provided by most antivirus, anti-spyware, and other anti-malware programs. This monitors computer systems for suspicious activity such as computer viruses, spyware, adware, and other malicious objects. Real-time protection detects threats in opened files and scans apps in real-time as they are installed on the device. When inserting a CD, opening an email, or browsing the web, or when a file already on the computer is opened or executed.

Issues of concern

Unexpected renewal costs

Some commercial antivirus software end-user license agreements include a clause that the subscription will be automatically renewed, and the purchaser's credit card automatically billed, at the renewal time without explicit approval. For example, McAfee requires users to unsubscribe at least 60 days before the expiration of the present subscription while Bitdefender sends notifications to unsubscribe 30 days before the renewal. Norton AntiVirus also renews subscriptions automatically by default.

Rogue security applications

Main article: Rogue security software

Some apparent antivirus programs are actually malware masquerading as legitimate software, such as WinFixer, MS Antivirus, and Mac Defender.

Problems caused by false positives

A "false positive" or "false alarm" is when antivirus software identifies a non-malicious file as malware. When this happens, it can cause serious problems. For example, if an antivirus program is configured to immediately delete or quarantine infected files, as is common on Microsoft Windows antivirus applications, a false positive in an essential file can render the Windows operating system or some applications unusable. Recovering from such damage to critical software infrastructure incurs technical support costs and businesses can be forced to close whilst remedial action is undertaken.

Examples of serious false-positives:

• May 2007: a faulty virus signature issued by Symantec mistakenly removed essential operating system files, leaving thousands of PCs unable to boot.
• May 2007: the executable file required by Pegasus Mail on Windows was falsely detected by Norton AntiVirus as being a Trojan and it was automatically removed, preventing Pegasus Mail from running. Norton AntiVirus had falsely identified three releases of Pegasus Mail as malware, and would delete the Pegasus Mail installer file when that happened. In response to this Pegasus Mail stated:

“ On the basis that Norton/Symantec has done this for every one of the last three releases of Pegasus Mail, we can only condemn this product as too flawed to use, and recommend in the strongest terms that our users cease using it in favour of alternative, less buggy anti-virus packages. ”

• April 2010: McAfee VirusScan detected svchost.exe, a normal Windows binary, as a virus on machines running Windows XP with Service Pack 3, causing a reboot loop and loss of all network access.
• December 2010: a faulty update on the AVG anti-virus suite damaged 64-bit versions of Windows 7, rendering it unable to boot, due to an endless boot loop created.
• October 2011: Microsoft Security Essentials (MSE) removed the Google Chrome web browser, rival to Microsoft's own Internet Explorer. MSE flagged Chrome as a Zbot banking trojan.
• September 2012: Sophos' anti-virus suite identified various update-mechanisms, including its own, as malware. If it was configured to automatically delete detected files, Sophos Antivirus could render itself unable to update, required manual intervention to fix the problem.
• September 2017: the Google Play Protect anti-virus started identifying Motorola's Moto G4 Bluetooth application as malware, causing Bluetooth functionality to become disabled.
• September 2022: Microsoft Defender flagged all Chromium based web browsers and Electron based apps like WhatsApp, Discord, Spotify as a severe threat.

System and interoperability related issues

Running (the real-time protection of) multiple antivirus programs concurrently can degrade performance and create conflicts. However, using a concept called multiscanning, several companies (including G Data Software and Microsoft) have created applications which can run multiple engines concurrently.

It is sometimes necessary to temporarily disable virus protection when installing major updates such as Windows Service Packs or updating graphics card drivers. Active antivirus protection may partially or completely prevent the installation of a major update. Anti-virus software can cause problems during the installation of an operating system upgrade, e.g. when upgrading to a newer version of Windows "in place"—without erasing the previous version of Windows. Microsoft recommends that anti-virus software be disabled to avoid conflicts with the upgrade installation process. Active anti-virus software can also interfere with a firmware update process.

The functionality of a few computer programs can be hampered by active anti-virus software. For example, TrueCrypt, a disk encryption program, states on its troubleshooting page that anti-virus programs can conflict with TrueCrypt and cause it to malfunction or operate very slowly. Anti-virus software can impair the performance and stability of games running in the Steam platform.

Support issues also exist around antivirus application interoperability with common solutions like SSL VPN remote access and network access control products. These technology solutions often have policy assessment applications that require an up-to-date antivirus to be installed and running. If the antivirus application is not recognized by the policy assessment, whether because the antivirus application has been updated or because it is not part of the policy assessment library, the user will be unable to connect.

Effectiveness

Studies in December 2007 showed that the effectiveness of antivirus software had decreased in the previous year, particularly against unknown or zero day attacks. The computer magazine c't found that detection rates for these threats had dropped from 40 to 50% in 2006 to 20–30% in 2007. At that time, the only exception was the NOD32 antivirus, which managed a detection rate of 68%. According to the ZeuS tracker website the average detection rate for all variants of the well-known ZeuS trojan is as low as 40%.

The problem is magnified by the changing intent of virus authors. Some years ago it was obvious when a virus infection was present. At the time, viruses were written by amateurs and exhibited destructive behavior or pop-ups. Modern viruses are often written by professionals, financed by criminal organizations.

In 2008, Eva Chen, CEO of Trend Micro, stated that the anti-virus industry has over-hyped how effective its products are—and so has been misleading customers—for years.

Independent testing on all the major virus scanners consistently shows that none provides 100% virus detection. The best ones provided as high as 99.9% detection for simulated real-world situations, while the lowest provided 91.1% in tests conducted in August 2013. Many virus scanners produce false positive results as well, identifying benign files as malware.

Although methods may differ, some notable independent quality testing agencies include AV-Comparatives, ICSA Labs, SE Labs, West Coast Labs, Virus Bulletin, AV-TEST and other members of the Anti-Malware Testing Standards Organization.

New viruses

Anti-virus programs are not always effective against new viruses, even those that use non-signature-based methods that should detect new viruses. The reason for this is that the virus designers test their new viruses on the major anti-virus applications to make sure that they are not detected before releasing them into the wild.

Some new viruses, particularly ransomware, use polymorphic code to avoid detection by virus scanners. Jerome Segura, a security analyst with ParetoLogic, explained:

“ It's something that they miss a lot of the time because this type of [ransomware virus] comes from sites that use a polymorphism, which means they basically randomize the file they send you and it gets by well-known antivirus products very easily. I've seen people firsthand getting infected, having all the pop-ups and yet they have antivirus software running and it's not detecting anything. It actually can be pretty hard to get rid of, as well, and you're never really sure if it's really gone. When we see something like that usually we advise to reinstall the operating system or reinstall backups. ”

A proof of concept virus has used the Graphics Processing Unit (GPU) to avoid detection from anti-virus software. The potential success of this involves bypassing the CPU in order to make it much harder for security researchers to analyse the inner workings of such malware.

Rootkits

Detecting rootkits is a major challenge for anti-virus programs. Rootkits have full administrative access to the computer and are invisible to users and hidden from the list of running processes in the task manager. Rootkits can modify the inner workings of the operating system and tamper with antivirus programs.

Damaged files

If a file has been infected by a computer virus, anti-virus software will attempt to remove the virus code from the file during disinfection, but it is not always able to restore the file to its undamaged state. In such circumstances, damaged files can only be restored from existing backups or shadow copies (this is also true for ransomware); installed software that is damaged requires re-installation (however, see System File Checker).

Firmware infections

Any writeable firmware in the computer can be infected by malicious code. This is a major concern, as an infected BIOS could require the actual BIOS chip to be replaced to ensure the malicious code is completely removed. Anti-virus software is not effective at protecting firmware and the motherboard BIOS from infection. In 2014, security researchers discovered that USB devices contain writeable firmware which can be modified with malicious code (dubbed "BadUSB"), which anti-virus software cannot detect or prevent. The malicious code can run undetected on the computer and could even infect the operating system prior to it booting up.

Performance and other drawbacks

Antivirus software has some drawbacks, first of which that it can impact a computer's performance.

Furthermore, inexperienced users can be lulled into a false sense of security when using the computer, considering their computers to be invulnerable, and may have problems understanding the prompts and decisions that antivirus software presents them with. An incorrect decision may lead to a security breach. If the antivirus software employs heuristic detection, it must be fine-tuned to minimize misidentifying harmless software as malicious (false positive).

Antivirus software itself usually runs at the highly trusted kernel level of the operating system to allow it access to all the potential malicious process and files, creating a potential avenue of attack. The US National Security Agency (NSA) and the UK Government Communications Headquarters (GCHQ) intelligence agencies, respectively, have been exploiting anti-virus software to spy on users. Anti-virus software has highly privileged and trusted access to the underlying operating system, which makes it a much more appealing target for remote attacks. Additionally anti-virus software is "years behind security-conscious client-side applications like browsers or document readers. It means that Acrobat Reader, Microsoft Word or Google Chrome are harder to exploit than 90 percent of the anti-virus products out there", according to Joxean Koret, a researcher with Coseinc, a Singapore-based information security consultancy.

Alternative solutions

The command-line virus scanner of Clam AV 0.95.2 running a virus signature definition update, scanning a file, and identifying a Trojan.

Antivirus software running on individual computers is the most common method employed of guarding against malware, but it is not the only solution. Other solutions can also be employed by users, including Unified Threat Management (UTM), hardware and network firewalls, Cloud-based antivirus and online scanners.

Hardware and network firewall

Network firewalls prevent unknown programs and processes from accessing the system. However, they are not antivirus systems and make no attempt to identify or remove anything. They may protect against infection from outside the protected computer or network, and limit the activity of any malicious software which is present by blocking incoming or outgoing requests on certain TCP/IP ports. A firewall is designed to deal with broader system threats that come from network connections into the system and is not an alternative to a virus protection system.

Cloud antivirus

Cloud antivirus is a technology that uses lightweight agent software on the protected computer, while offloading the majority of data analysis to the provider's infrastructure.

One approach to implementing cloud antivirus involves scanning suspicious files using multiple antivirus engines. This approach was proposed by an early implementation of the cloud antivirus concept called CloudAV. CloudAV was designed to send programs or documents to a network cloud where multiple antivirus and behavioral detection programs are used simultaneously in order to improve detection rates. Parallel scanning of files using potentially incompatible antivirus scanners is achieved by spawning a virtual machine per detection engine and therefore eliminating any possible issues. CloudAV can also perform "retrospective detection", whereby the cloud detection engine rescans all files in its file access history when a new threat is identified thus improving new threat detection speed. Finally, CloudAV is a solution for effective virus scanning on devices that lack the computing power to perform the scans themselves.

Some examples of cloud anti-virus products are Panda Cloud Antivirus and Immunet. Comodo Group has also produced cloud-based anti-virus.

Online scanning

Some antivirus vendors maintain websites with free online scanning capability of the entire computer, critical areas only, local disks, folders or files. Periodic online scanning is a good idea for those that run antivirus applications on their computers because those applications are frequently slow to catch threats. One of the first things that malicious software does in an attack is disable any existing antivirus software and sometimes the only way to know of an attack is by turning to an online resource that is not installed on the infected computer.

Specialized tools

The command-line rkhunter scanner is an engine to scan for Linux rootkits running on Ubuntu.

Virus removal tools are available to help remove stubborn infections or a certain type of infection. Examples include Windows Malicious Software Removal Tool, Sophos Scan & Clean, and Kaspersky Virus Removal Tool. It is also worth noting that sometimes antivirus software can produce a false-positive result, indicating an infection where there is none.

A rescue disk that is bootable, such as a CD or USB storage device, can be used to run antivirus software outside of the installed operating system in order to remove infections while they are dormant. A bootable rescue disk can be useful when, for example, the installed operating system is no longer bootable or has malware that is resisting all attempts to be removed by the installed antivirus software. Examples of software that can be used on a bootable rescue disk include the Trend Micro Rescue Disk, Kaspersky Rescue Disk, and Comodo Rescue Disk. Most of the rescue disk software can also be installed onto a USB storage device that is bootable on newer computers.

Usage and risks

According to an FBI survey, major businesses lose $12 million annually dealing with virus incidents. A survey by Symantec in 2009 found that a third of small to medium-sized business did not use antivirus protection at that time, whereas more than 80% of home users had some kind of antivirus installed. According to a sociological survey conducted by G Data Software in 2010 49% of women did not use any antivirus program at all.

See also

• Anti-virus and anti-malware software
• CARO, the Computer Antivirus Research Organization
• Comparison of antivirus software
• Comparison of computer viruses
• EICAR, the European Institute for Computer Antivirus Research
• Firewall software
• Internet security
• Linux malware
• Quarantine (antivirus program)
• Sandbox (computer security)
• Timeline of computer viruses and worms
• Virus hoax

General bibliography

• Szor, Peter (2005). The Art of Computer Virus Research and Defense. Addison-Wesley. ISBN 978-0-321-30454-4. 

      PLEASE BE CAUTIOUS ADDING MORE EXTERNAL LINKS.

Wikipedia is not a collection of links and should not be used for advertising.

    Excessive or inappropriate links will be removed.

See Wikipedia:External links and Wikipedia:Spam for details.

If there are already suitable links, propose additions or replacements on the article's talk page, or submit your link to the relevant category at the Open Directory Project (dmoz.org) and link there using Lab Kaspersky Lab at Curlie. -->