A scanner stays resident in memory and raises an alarm the moment a running program starts overwriting other executables, whatever that program looks like on disk. Which antivirus generation is it?

Answer

Third generation

Options - A. Third generation - B. First generation - C. Second generation - D. Fourth generation Why - A. Correct — third-generation activity traps are memory-resident and match on behaviour. Their economy is that only a small set of actions indicates malicious activity, however many specimens exist. - B. First generation is the simple **signature** scanner: a known bit pattern, so it matches on structure and only catches known malware. A variant of it records program lengths and watches for changes. - C. Second generation is **heuristic** — rules for probable infection, and integrity checking with an encrypted hash. Still structural: it reasons about what the code looks like, not what it does. - D. Fourth generation is the **full-featured** package: scanning **and** activity traps **and** access control together. It contains generation three rather than being it, so it is the wrong answer to a question that describes activity traps alone. The ordinal is the whole question, and the neighbours are the distractors. Anchor it: 1 = signature, 2 = heuristics and integrity, 3 = behaviour, 4 = everything plus access control.

Stallings & Brown, Computer Security 5e, ch6 §6.10