Gone are the days of simple passive signature scanners. Now they all sink their claws deeply into the OS intercepting filesystem operations, network packets, an

Gone are the days of simple passive signature scanners. Now they all sink their claws deeply into the OS intercepting filesystem operations, network packets, and any other privileged activity. Well, things have been like that for a long time already. E.g. Thunderbyte used an ISA card in the early 90ies to insert itself before and outside the operating system [1]. Old anti-virus programs also used Terminate and Stay Resident (TSR) [2] [1] https://en.wikipedia.org/wiki/ThunderByte_Antivirus https://en.wikipedia.org/wiki/ThunderByte_Antivirus [2] https://en.wikipedia.org/wiki/MSAV https://en.wikipedia.org/wiki/MSAV