AV companies have different definitions for the word payload. As an arbitrary base definition, Wikipedia defines payload as such:

the payload of a virus or worm is any action it is programmed to take other than merely spreading itself. The term is used for all intended functions, whether they actually work or not.

The Computer Desktop Encyclopedia says payload:

…refers to the software’s harmful results. Examples of payloads include data destruction, messages with insulting text or spurious e-mail messages sent to a large number of people.

Symantec has a slightly similar definition:

This is the malicious activity that the virus performs. Not all viruses have payloads, but there are some that perform destructive actions.

Trend Micro has a different take on the definition:

The term payload refers to an action that a malware or grayware performs, apart from its main behavior. For example, payloads for a worm include all other actions it performs apart from its propagation routines.

Payloads can range from something that is relatively harmless, like displaying messages or ejecting the CD drive, to something destructive, like deleting the contents of a hard drive.

McAfee defines payload as follows:

Refers to the effects produced by a virus attack. Sometimes refers to a virus associated with a dropper or Trojan horse.

From the Big Three’s definition, Trend Micro’s definition deviates from the Wikipedia and the other two quoted companies. Kaspersky, Sophos, and F-Secure do not have definitions on payload. Uniformity has never been AV companies’ forte; they don’t even name malware the same way. But based on the definitions we can safely say that payload refers to the malicious activities that a malware does. We are stumped by Trend Micro’s definition, since the definition will be problematic for Trojan horses.

Trojan horse is a general term that covers malware with different behavior. Based on its definition, Trend Micro sees payload as actions of a malware aside from its main routine. For Trojans, we ask: what is a Trojan’s main routine? It will now depend on what kind of a Trojan a malware is – whether it is a downloader, a dropper, a proxy server, etc.

That’s why I prefer the other’s definition – it has all bases covered.

In the book The World is Flat, Thomas Friedman detailed the reasons behind the success of Apache, the open-source, free Web server software. He said that community-developed software helped in flattening the world. The consumer can now use software without even buying it, and it empowers ordinary geeks to create and share. You do not have to be part of a large software company to create a killer app. And it connects several people to collaborate on a certain power.

Basically, Friedman argues that flattening the world means empowering the people, reducing the top-down structure in a peer association.

He used Apache as an example of a successful free, open-source software. He also mentioned Linux, OpenOffice.org, and Gimp as examples.

Microsoft and other software companies are divided on the issue of open source. Microsoft’s position, according to Friedman, is that open-source does not reward innovators financially. Since there is no financial reward for innovations, R&D will be greatly affected. Bill Gates himself has stated that capitalism drives innovation.

And let’s face it, support for free or open-source software are at best limited to online fora and knowledgebases.

That brings me to antivirus. There is one free, open-source antivirus out there – Clam AV (and its Windows equivalent, ClamWIN). There are free, but not open source, antivirus out there – Alwil’s Avast! Home Edition, Avira’s AntiVir PersonalEdition Classic, and Grisoft’s AVG Free Edition. Now, all of them offer limited support, as opposed to what the Big Three (Symantec, McAfee, Trend Micro) offer.

Based on tests, these free AV software fared well on several tests, but had problems on new malware and spyware detection. Clam AV is not even usually tested; here’s a PC Magazine report, and Clam AV is not included. (Try looking at AV-Test.org and Virus Bulletin to check on how AV software performed on several tests.)

Now, the fact that open-source AV doesn’t perform well, and no support, users are advised to use free ones provided by Alwil, Avira, and Grisoft.

What should Clam AV do now? Continue developing their product, concentrate on heuristics and behavior detection research (intrusion detection will be a bonus), and Clam AV will give the Big Three a run for their money. That will not happen very soon, but time is on their side. They should take advantage of the community of geeks out there, empower them, and consumers’ interest will follow soon.

Now, in conclusion, Microsoft’s opinion on innovation is basically correct – it is a human tendency to seek reward for accomplishments, and money is a great motivator. But Microsoft and adherents are forgetting that humans also tend to seek approval from peers and to contribute for the common good; Friedman believes that that drove the success of Apache and other open source products. Don’t underestimate the power of human nobility.