Which of the following statements is correct regarding computer viruses and modern antivirus systems?

Question

Which of the following statements is correct regarding computer viruses and modern antivirus systems?

1. A. A virus can execute automatically without user action once present in memory.
2. B. Signature-based antivirus detects only previously identified malware patterns. (Correct answer)
3. C. Online registration guarantees protection against zero-day attacks.
4. D. A firewall and antivirus perform exactly the same function.

Correct Answer

Option B — Signature-based antivirus detects only previously identified malware patterns.

Detailed Solution & Explanation

The correct answer is Signature-based antivirus detects only previously identified malware patterns.

Key Points

• Signature-based detection works by comparing files against a database of signatures — distinctive byte patterns or hashes extracted from known malware. It is fast and produces very few false positives, but by definition it can only recognise threats that have already been identified and catalogued. This is precisely why virus definitions must be updated continually.
• Why the other statements are wrong:
  • Option A — a virus requires a host program and user action to execute; it cannot run merely by being present in memory. Self-executing, self-propagating code without user action is a worm, not a virus. This distinction is the crux of the question.
  • Option C — no registration can guarantee protection against zero-day attacks, which by definition exploit vulnerabilities that are not yet known or patched.
  • Option D — a firewall filters network traffic by rules on ports, addresses and protocols, while an antivirus inspects files and processes for malicious code. They are complementary, not identical.

Additional Information

• Detection methods used by modern antivirus software:
  • Signature-based — matches known patterns; fast, but blind to new threats.
  • Heuristic — flags suspicious code structures resembling known malware families.
  • Behaviour-based — monitors what a program actually does at run time, and can therefore catch novel malware.
  • Sandboxing — executes a suspect file in an isolated environment to observe its behaviour safely.
  • Cloud and machine-learning based — compares against continuously updated threat intelligence.
• Types of malware: virus (needs a host and user action); worm (self-replicating, spreads without user action); trojan (disguised as legitimate software); ransomware (encrypts data and demands payment); spyware and keyloggers (covert monitoring); rootkit (conceals itself at a privileged level); adware; and botnets.
• Zero-day attacks are countered not by signatures but by behaviour-based detection, prompt patching, least-privilege access and network segmentation.