How Does Antivirus Software Work?

Learn how antivirus software works, plus the reasons why you should use it.

You'll never regret investing in good antivirus software for your computer. It's like insurance — even if you never accidentally download an infected file, you'll be extremely glad you have the program when it protects you.

For instance, one friend saved himself from having to reinstall his entire system because his copy of McAfee's VirusScan identified a virus in a file a commercial artist had given him.

Surprisingly, the artist knew his computer had been crashing a lot lately, but still couldn't be bothered to get an antivirus program for himself — he's probably still passing out infected files to his clients.

Unfortunately choosing an antivirus program isn't as simple as it should be. Some programs, even well know brands, can actually slow your computer down, even to the point where it no longer functions efficiently.

A quick note: Always make sure you only have one antivirus program installed on your computer since having two or more working simultaneously can really affect your computer's performance, not to mention affect the efficacy of the antivirus program.

How does antivirus software work?

The most popular antivirus programs, whether they're free ‎or not, scan your hard drive for infected files. 

They look for markers, usually internal strings of code, for known viruses, and sometimes also check a file's name against a database of known Trojan horses. Good antivirus software also lets you update its database of known viruses and Trojan horses. But since this won't catch the newest of the new viruses, the programs can also check to see if a program, or your system, is modifying itself.

The very best antivirus programs can also scan a thumb drive or external hard drive and check a downloaded file the moment it's saved to your computer. Or alternately, quickly check a file when you launch it so you're protected before a virus can even make it to your system.

Though these are all good indicators of a virus, they can also mean you've installed a new program or you're using a self-modifying program, like a database. The many false-positives you get from your antivirus when it detects these types of programs can be annoying. 

Should you use antivirus software to remove a virus?

If your antivirus software identified a virus, it can strip the virus out of the file, though some experts don't recommend doing this. 

It's best to replace an infected file with an uninfected copy. If you're a conscientious computer user, you back up your computer regularly — that is, every time you use it. Though an antivirus program will successfully remove a virus (or tell you if it can't), it could damage the original file.  Or worse yet, leave a "virus ghost" that sets off the antivirus alarm even though it's harmless.

Trends in malware are always changing as exploiters try to keep ahead of the anti-malware products designed to stop them. 

Make no mistake cybersecurity is gaining more and more attention, and your online privacy and security shouldn't be taken lightly. This is why it's very important to keep whatever virus protection you use up to date.