How does antivirus software work?

Anti-virus software scans your device for harmful files. These harmful files are called viruses or malware and they cover a wide variety of threats such as Trojans, worms, spyware, adware, keyloggers, cryptojackers, rootkits and more. In most cases, the purpose of malware is to damage your device or access your sensitive data for financial gain, or both.

The antivirus software uses a malware database to see if the code of the scanned file matches the code of known malware in the database. It also checks for files that are similar to the database files. Advanced software such as Norton and Bitdefender also use machine learning techniques to detect malware based on its behaviour. Antivirus software detects new or rampant malware in these ways.

In addition to having on-demand malware scanners that are launched to detect and remove malware that has infected the system, antivirus software also has a real-time protection feature that actively scans for running programs in real time. This feature is therefore able to stop malware before they infect your device.

Anti-virus software sometimes marks safe files as unsafe, which is known as a 'false positive'. If this happens, all you have to do is whitelist the malicious program and the antivirus will allow it to run. It is easy to whitelist a file, but you should only be able to do this if you are sure that the file is 100% safe.