What are the weaknesses of activity monitors?
It is very hard to tell the difference between a word processor updating a file and a virus infecting a file. Activity-monitoring programs may be more trouble than they are worth because they can continually ask for confirmation of valid activities. If you restrict the operations that a computer can perform, you can eliminate viral programs. Unfortunately, you also can eliminate most of the usefulness of the computer. Activity monitors may also be bypassed by viral programs that do low-level programming rather than using the standard operating system calls, or those that actually replace the standard system calls with viral triggers. In addition, while new viral technologies, such as stealth and polymorphism, have little effect on activity monitoring, new concepts in viral spread, such as companion or spawning viruses require new checks to be added to monitors. Activity monitors have a good chance to detect viral activity of new and unknown viral strains, but it would be very difficult
