Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What I like about about the boot-able CD concept, is it can connect to the Internet and get updates, however I'm not clear how effective they are at really finding things that are heuristic? How do heuristic scans even work, if an executable isn't actually running?

share|improve this question
    
I think you're conflating two independent aspects: bootable CD, and heuristics. You might want to split this into two separate one questions, one asking why they have you boot from a CD, and a separate one asking how heuristics work when scanning your hard drive to find malware that isn't currently running. –  D.W. Nov 18 '11 at 18:11

2 Answers 2

up vote 1 down vote accepted

Running from a bootable CD does not make the antivirus better at detecting virus, it just avoids said virus to rig the antivirus into seeing nothing at all. The antivirus on a bootable CD is the same than the antivirus on the live machine; the bootable CD just makes it safer for the antivirus itself.

Heuristic detection is completely orthogonal. An antivirus classically works by finding snippets of known virus code in executable files (the "signatures"). Some virus go one step further in the hide&seek game they play with antivirus software, and alter their own code in multiple ways with a bit of randomness. Antivirus software vendors react by making meta-code which tries to identify code snippets which, while not being bit-to-bit identical to known virus signatures, could possibly be some sort of automatically modified virus code, because at this place in this file it looks definitely fishy. "Heuristic detection" is often a marketing name for "a shot in the dark".

share|improve this answer

The core difference a boot disk gives you is the ability to scan the applications through a 'known good' fliesystem, as opposed to a potentially rootkitted filesystem, which may hide any/all malware from a scanner.

The basic problem is that if malware has compromised your system, it could be configured to return anything the author wants when a scan of a file is run, to make it appear the system is clean.

By booting from a CD or other read-only material, as long as you have a clean boot disk it will not be able to be compromised by malware and should give correct results. The assumption here is that you have a clean download.

Aside from that, the usage is the same as a version running on the normal OS - scanning for known patterns, or code which meets certain suspicious indicators.

share|improve this answer
1  
So do heuristic scans simply look for patters in files as well? I guess my understanding of heuristic detection is based on seeing how some potential malware is behaving, but in my limited mind, I would envision the executable would need to be running to see what it's doing. What am I missing? Thanks again for trying to enlighten me. –  AncientAnt Nov 18 '11 at 16:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.