Hundreds of thousands of new viruses appear DAILY — and correspondingly, tens of thousands appear every hour. The overwhelming majority of them are modifications—brothers and sisters of existing viruses. Yes, the Dr.Web heuristic analyser and the Dr.Web behavioural analyser really do make it possible to detect with a high degree of probability that a file has been infected or is a Trojan itself. But “probably infected” does not mean “infected for sure”! This file will be declared a virus only after its virus signature has been added to the Dr.Web virus database.
But no anti-virus software vendor will ever guarantee you that today won’t be the day that somebody writes a brand new virus that can’t be detected by even the most perfect heuristic analyser.
As a rule, malicious programs reach their victims at the same time they reach the Doctor Web anti-virus laboratory for analysis, and in the case of the newest malicious programs (those not yet detected by any available mechanism), anti-virus analysts need time to develop and test a “cure”. Frequent updating makes it possible to minimise the time it takes for potential victims of criminal attacks to get hold of updates. Often ‘cures’ for malicious files are available, but have not yet been downloaded.
Unlike its competitors, Doctor Web’s principled position is to release updates as frequently as possible so as to minimise the time period during which new threats can pose a danger.
That is why the anti-virus databases need to be updated every time the computer is connected to the Internet or as frequently as possible if the connection is continuous.