What are the strengths of activity monitors?
Activity monitors can detect “unknown” (that is, not previously identified) viral programs, and do not require a database of signatures of known viruses. Activity monitors generally require less frequent updates than do scanners. Activity monitors do not require the same level of setup as do authentication or change detection systems. Activity monitors may be able to function on already infected systems. Activity monitors represent some of the oldest examples of antiviral software. Generally speaking, such programs followed in the footsteps of the earlier anti-trojan software, such as BOMBSQAD and WORMCHEK in the MS-DOS arena, which used the same “check what the program tries to do” approach. This tactic can be startling effective, particularly given the fact that so much malware is slavishly derivative and tends to use the same functions over and over again.
