What Is Antivirus?
Antivirus is a software program that’s designed to prevent malware infections, detect existing threats and attacks, and eradicate them from singular computing devices or entire IT systems. These programs scan websites, files and installed programs for suspicious activity. They also look at day-to-day program behavior to spot anomalies that might indicate malicious intent.
Most antivirus products use signature-based detection methods, which compare the digital fingerprints of known threats to malware databases maintained by cybersecurity vendors. However, this type of analysis requires a significant amount of processing power and can be thwarted by tampering by developers who release polymorphic malware strains that change their code signatures over time.
To counter this, some antivirus programs employ a behavior-based detection method. Rather than parsing a database, these programs run a file or program in a virtual sandbox environment and only permit it to execute in the real world if the sandbox analysis confirms that it’s safe.
AV products are critical in mobile environments, as well, where malware can lurk even in seemingly benign app repositories like Apple’s App Store or Google Play. These products monitor apps for rogue functionality and if they suspect that an app is a threat, they can delete or block access to the app.
In addition, some antivirus programs can detect and eliminate rootkits, which are tools that gain entry to a device and can hide from its operating system. Others can thwart ransomware, which locks a user’s computer and demands payment in order to unlock it; and spyware, which enters a device, spies on activities and generates unwanted ads.