Antivirus software detects, blocks and removes malicious programs on computers and mobile devices.
How antivirus works
Despite its name, modern antivirus protects against all kinds of malware, not only viruses. It combines several detection methods:
- Signatures – byte patterns and hashes of known malicious files.
- Heuristics – rules that flag suspicious code structure or behaviour in unknown files.
- Behavioural monitoring – watching what programs do at run time, such as mass file encryption or code injection into other processes.
- Cloud reputation and machine learning – checking files and URLs against data collected from millions of devices.
Products also scan email attachments, downloads and websites. Microsoft Defender Antivirus is built into Windows, and most vendors now sell antivirus as part of an endpoint protection platform (EPP).
Limitations of antivirus
Attackers test their malware against popular engines before using it, and rely on obfuscation, fileless techniques and legitimate admin tools to stay under the radar. Ransomware gangs often disable antivirus first, for example by loading a vulnerable signed driver (“bring your own vulnerable driver”, BYOVD). Antivirus alone therefore cannot stop targeted attacks; companies add EDR to record endpoint activity and support investigation.
Best practices
- Keep antivirus enabled and updated on every device, including servers.
- Turn on tamper protection so that malware cannot switch it off.
- Do not ignore alerts and quarantine messages – they are often the first sign of an intrusion.
- Combine antivirus with patching, backups and phishing-resistant authentication.
