User Guide

User’s Guide 31
About Dr Solomon’sAnti-Virus
How does Dr Solomon’sAnti-Viruswork?
DrSolomon’sAnti-Viruscombinestheanti-virusindustry’smostcapablescan
engine with top-notch interface enhancements that give you complete access
to that engine’s power. The Dr Solomon’s Anti-Virus graphical user interface
unifies its specialized program components, but without sacrificing the
flexibility you need to fit the software into your computing environment. The
scan engine, meanwhile, combines the best features of technologies that
McAfee and DrSolomon researchers developed independently for more than
adecade.
Fast, accurate virus detection
The foundation for that combination is the unique development environment
that McAfee and Dr Solomon researchers constructed for the engine. That
environment includes Virtran, a specialized programming language with a
structure and “vocabulary” optimized for the particular requirements that
virusdetectionandremovalimpose.Usingspecificlibraryfunctionsfromthis
language, for instance, virus researchers can pinpoint those sections within a
file, a boot sector, or a master boot record that viruses tend to infect, either
because they can hide within them, or because they can hijack their execution
routines. This way, the scanner avoids having to examine the entire file for
viruscode;itcaninsteadsamplethefileatwelldefinedpointstolookforvirus
code signatures that indicate an infection.
Thedevelopmentenvironmentbringsasmuchspeedto.DATfileconstruction
asitdoes toscanengineroutines. The environmentprovidestools researchers
can use to write “generic” definitions that identify entire virus families, and
thatcaneasilydetectthetensorhundredsof variants that make up the bulk of
new virus sightings. Continual refinements to this technique have moved
most of the hand-tooled virus definitions that used to reside in .DAT file
updates directly into the scan engine as bundles of generic routines.
Researchers can even employ a Virtran architectural feature to plug in new
engine “verbs” that, when combined with existing engine functions, can add
functionality needed to deal with new infection techniques, new variants, or
other problems that emerging viruses now pose.
This results in blazingly quick enhancements the engine’s detection
capabilities and removes the need for continuous updates that target virus
variants.