Software publishers offer free virus removal tools in response to the threat of a particular virus. It is therefore a "tool" in the strictest sense of the word. These removal tools have a limited but important role. They are designed for emergency situations, when a PC is infected and has no virus protection system installed (a serious error!). Often, the computer is very unstable, making it difficult to install a complex anti-virus program. Sometimes the virus may prevent such an installation or even neutralize the virus signature updating process (this has already been reported). In such situations, a removal tool is the best answer.
Another aspect of these tools is their mobility and ease of use: they are usually small and, above all, they require no installation. This means they can be kept on a diskette or USB key and executed on any infected workstation in order to wipe out the particular virus they are designed to remove. You may often see them in the pockets of the more "street wise" Internet users when they go to visit their less-informed friends. However, even though some of these virus removers are capable of recognizing several viruses of a given family, or even several viruses of various widespread families, these tools should not be used as a regular protection system.
First of all, it is self-evident that a genuine anti-virus program has a database of tens of thousands of virus signatures and their variants as compared to a removal tool, which only knows a dozen or so at best (and more usually just one). Outside of its role as an emergency tool for cleaning up a machine that is already suspected of infection (and therefore nearly unusable), the virus remover is of little other use. It is incapable of recognizing another moderately common virus or even a virus that is just a few months old.
Next, in addition to its signature database, a true anti-virus program usually uses several generic detection techniques that can identify unknown viruses or those that have been specially modified to escape detection by signature. A genuine anti-virus program can send an alert if it finds that an unknown program has a structure that could potentially be a virus or if it behaves in ways that are common to viruses (piggy-backing on other programs, writing to certain sensitive portions of the hard disk, for example). The virus remover will totally ignore all of these things, of course!
And a real anti-virus program protects the computer at all times, not just when you think about running it. The "resident module" analyzes all of the files that come into the computer on a continuing basis and sends an alert whenever one of these is downloaded or saved to the disk. Even better, it will alert you if you click on the infected file by accident, blocking execution and preventing the virus from taking advantage of your mistake to infect your computer. This real-time analysis is what gives an anti-virus program its true added value and is painfully absent from the free virus removal programs. Furthermore, a good anti-virus program can interface with your e-mail client (such as Outlook) and even with your chat program (MSN or other) to directly intercept files that travel by these routes, analyzing them on the fly. The virus removal program can only repair the damage, after it is too late!
