Doesn’t antivirus software protect my systems from network worms?
No. Because antivirus programs detect existing worms based on known signatures and code injection into file systems, antivirus protection from worms is inherently limited and reactionary. Until a worm is known and a signature created and updated, the antivirus program cannot provide protection against the malicious code. Even when the worm is known, if it executes itself from memory without executing from the file system, most antivirus programs are not capable of protecting a system against it. Even after the signature is developed anti-virus software typically monitors email attachments and file directories that are accessed by the user through Windows explorer. Most worms hide themselves in less accessed system directories which will only be processed by AV software during the full file scan. Which means that in most cases AV will help clean up the worm after it infected the machine and infected many other systems.
