G Data Antivirus

Description

G Data Software AG — now G Data CyberDefense AG — has an important historical position in the development of antivirus software: the company says it released the first antivirus software in the world in 1987, developed by founders Kai Figge and Frank Henis, both in Bochum, Germany, for the Atari ST platform. Whether the “first antivirus” distinction belongs to G Data or one of several programs that came before is disputed in security history, but G Data’s early entry into the field established the Bochum company as a long-tenured participant in the security software market.

The current antivirus product is based on a dual-engine architecture — G Data’s own detection engine plus a licensed engine from Bitdefender — running in tandem to cross validate detection results. The dual-engine approach is used to increase detection rates by having each file scanned by two separate and independent analysis systems at the expense of increased resource consumption compared to single-engine products.

Dual-Engine Detection

G Data Antivirus includes two separate detection engines on each file scanned: the G Data engine, which is proprietary, and a Bitdefender engine, which is licensed from the Romanian security company. Each engine applies its own signature database, heuristic analysis and behavioral monitoring independently. A file that one engine doesn’t identify as malicious gets a second look from the other engine, making it less likely that a new threat would escape detection because it evades one engine’s heuristics. Independent testing results for G Data consistently put it in the top detection rate tiers, which the company attributes in part to the dual-engine redundancy.

Real-Time Protection

Real-time file system monitoring scans files as they access — on open, copy, write, and execution. The monitoring includes the local file system and network shares that are accessed from the machine. Files that match signatures or have suspicious behavioral patterns cause quarantine actions before execution is completed. The guard runs all the time as a background service and updates its signature databases based on a configurable schedule.

Exploit Protection

The exploit protection component monitors running applications for patterns of behavior that are associated with exploit attacks — memory injection, heap spray techniques, return-oriented programming indicators and other attack methods that target application vulnerabilities rather than deploying standalone malware files. Exploit attacks that do not involve the creation of a detectable malware file need behavioral detection, not signature matching, and the exploit protection layer covers that area specifically.

Web Protection

The browser-integrated web protection verifies URLs against the database of malicious and phishing sites maintained by G Data before loading. The filter covers websites distributing malware, phishing pages mimicking banking and shopping websites, and websites with fraudulent content. The web protection operates in Chrome, Firefox and Edge using browser integration, and protects any browser’s traffic at the network layer independent of browser extensions.

Virus Scan Options

G Data Antivirus offers several scan options: quick scan, which focuses on running processes and common infection points; full system scan, which scans all drives and files; custom scan, which scans user-defined folders; and boot-time scan, which scans files before the operating system (Windows) is loaded. Full scans are automatically run at configured times by the scan scheduler.

BankGuard

BankGuard monitors banking and payment website sessions in the browser and detects man-in-the-browser attacks where malware is used to modify the browser’s behavior to alter financial transactions. The protection checks to make sure that the browser code used for the banking pages has not been altered by malicious software and alerts when unauthorized attempts to inject code are made.

Ransomware Protection

The anti-ransomware component monitors the file system for patterns related to ransomware — rapid sequential file modifications, encryption operations on a large number of files, and attempts to delete shadow copies that would otherwise enable file recovery. Detected ransomware behavior causes an immediate block before significant file encryption takes place.