Knowing how your antivirus works can be useful. Understanding how antivirus software identifies threats and prevents them from infecting your operating system can help you protect your computer from infiltration. And, if you’re paying for a premium product, you’ll want to know what makes it tick.
Antiviruses use two main methods to tackle malware, the first being databases. This strategy is pretty simple: threats are identified by researchers who publicize information about the malware they find, and antiviruses add these new viruses to their lists of dangerous files. If you’re using an antivirus, and it detects anything on the no-no list, it will block it from running. This requires regular definition updates to counter the latest malware and doesn’t work against brand-new threats.
To tackle as-yet unidentified malware, the best antiviruses use behavior-based detection. This is much more complex, as it requires programmers to dig deep and write complex code that can identify dangerous software based on what it does. Top security tools like Norton use heuristics and advanced machine learning to catch malware.
Before we dig any deeper, let’s take a closer look at how viruses work.
What Is a Virus and How Does It Work?
Viruses operate pretty much like any other program you might install onto your device. The main difference, however, is the intent behind the program. Viruses are meant to steal or destroy your data and damage your device’s critical functions.
Unlike other malware, viruses are capable of replicating themselves. However, ‘virus’ is often used as a general term for all kinds of malware. Next, I’ll cover these specific types of malware.
What Can Viruses Do?
As we’ve addressed, the word ‘virus’ refers to how certain pieces of malware work, not the nature of the threat they pose to your privacy and your device’s security. Now let’s take a look at the effects malware can have on your device. A good antivirus will, as it happens, counter all of these threats. Note that the categories listed below could be delivered by a virus, a worm, or any of the other forms malware can take.
Ransomware
Ransomware attacks are blunt but destructive. When activated, ransomware will try to encrypt any data on your hard drive, preventing you from accessing essential files. If ransomware is successful, you’ll receive notifications threatening to delete your data unless you pay the hackers responsible. Of course, even if you do pay up, there’s no guarantee that they’ll unlock your devices.
All sorts of people and devices get targeted by ransomware attacks, from huge multinational corporations to individual PCs. Even non-profit organizations can be counted among the growing list of ransomware victims. Little Red Door, out of Indiana, is one such example. Hackers demanded that the charity (which supports cancer patients and their families) fork over $43,000 in order to regain access to critical data.
With all these threats lurking about, it’s no wonder that security experts have created countermeasures to keep people safe from malware in all its ugly forms.
Adware
Though not as harmful as ransomware, adware is still not the sort of program you want running on your computer. Whether delivered bundled with another piece of software or landing on your hard drive as a result of a drive-by download, adware will result in additional ads annoying you whenever you use your device. This means pop-ups which can occur even when your browser isn’t running.
A lot of adware can be categorized as potentially unwanted programs (PUPS). This refers to software that, while not illegal or seriously malicious, tends to be annoying and delivered without users really realizing what they’re getting into.
Avoid clicking on any ads. That’s generally a good rule, and it applies doubly if you’re suffering from adware. Even if the adware itself isn’t dangerous, there’s no telling what the ads it generates will do to your device. Adware developers tend to be pretty sketchy and are liable to allow (knowingly or unknowingly) cybercriminals to run ads using their software.
In addition to an antivirus that can remove adware and other PUPs, you may want an ad blocker to help you stay safe.
Spyware
As the name implies, spyware is created to spy on victims. Depending on the subtype, spyware might monitor your location, internet history, keystrokes, or even hijack your device’s webcam and microphone to record you. On the less sketchy end of the spectrum, hackers use the information to send targeted ads or sell your info to data brokers or scammers. But the potential harm is far greater: we’re talking extortion and identity theft.
Most types of spyware are easily tackled by a premium antivirus like Norton. Spyware can affect all types of devices, so it’s important to exercise caution everywhere you go. Worryingly, certain advanced types of spyware (namely Pegasus) cannot be easily countered.
How Antivirus Software Identifies and Prevents Malware
Antivirus software runs quietly in the background of your computer, completing repeated scans of your data, system files, and computer programs.
Antiviruses keep an eye out for:
- Known pieces of malware, which they reference against huge knowledge bases and dictionaries kept by their creators.
- Suspicious patterns or behavior; antiviruses constantly look for unusual activity that can’t be explained by a user playing with their system and doesn’t seem related to any legitimate program.
- Any incoming data, messages, or installations. Any new app you install or file you download will be checked by the antivirus.
When an antivirus detects a threat, it will usually alert you and remove the malicious software.
Cross-checking definition files in a database for known malicious software is one of the ways antivirus software works to defend your system. But that leaves an obvious, gaping hole: what about viruses so new or stealthy they haven’t yet been identified and added to the database?
The good news is that reliable antivirus tools do a good job dealing with these new threats. Firstly, they use heuristic detection or analysis. Instead of trying to detect just a single signature and falling victim to a mutation, antivirus software will combine related ones into ‘families.’ That way, they can use a broader generic signature to identify anything that looks or smells or acts like a virus from each family. That’s not the only trick up their sleeve, though.
Antiviruses also use rootkit detection to check and see which actions a program is attempting to execute, and based on those actions, determine whether it’s malicious (and how to stop it accordingly).
They can also use sandboxes to test a new file or run a new piece of software in a safe, isolated environment. The antivirus will then watch what happens, and what the program tries to do. It’s only when everything checks out that the program will actually be allowed to run on your device.
Last but not least, antivirus software layers machine learning onto these behavior-based techniques. That way, it can predict what’s about to happen (based on previous similar actions) and stop the malware in its tracks before it causes harm.
You’ll notice that the key to antivirus software success isn’t through one tactic. Viruses are too nimble and sophisticated, able to shapeshift at a moment’s notice to easily bypass one or two security checkpoints. Instead, antiviruses combine a few different strategies with different methods of detection to stop as many attacks as possible.
What Features Do Antiviruses Offer?
The very best antiviruses will offer much more comprehensive protection than just simple virus scans. Here’s what a good antivirus should offer:
System Scans
Any antivirus worth its salt will be able to scan your system for threats.
Extremely basic and often free versions will sometimes only run a scan when prompted by the users, while higher end builds will run regular and real-time scans, and give you a variety of custom options too.
Malware Removal
Once malware has been found, an antivirus won’t do you much good if it can’t also remove the threat!
Not all virus elimination is created equal, however, with higher-end antiviruses usually outscoring competitors in independent lab tests that measure a number of factors, including thoroughness of scans and removal.
Ransomware Protection
Ransomware is a particularly nasty form of malware that gathers your most important data and locks it away behind complex encryption.
In order to receive the key to unlock your files, you’re asked to pay the attackers a ransom — and even then there’s no guarantee you’ll get your files back.
While most antiviruses will be able to remove ransomware, that won’t get you your files back! The best ones like Bitdefender will offer proactive protection and delete the malware before it impacts your files, offer you a secure place to store your most important data where criminals can’t touch it, and even restore files encrypted by ransomware.
Phishing Protection
Phishing and social engineering are more advanced identity theft tactics that work by manipulating you into willingly handing over passwords, banking information, and more.
Top-notch antiviruses like Norton will recognize phishing attempts and alert you before you make the crucial mistake of sharing your information with the wrong person.
Wi-Fi Inspection
How often do you join a public Wi-Fi network on your phone or laptop without giving it a second thought?
The frightening truth is that it’s easy for hackers to set up fake networks and steal your personal information when you join.
A really good antivirus will be able to scan a public Wi-Fi network for vulnerabilities and suspicious behavior before you connect and compromise your device.
Extra Features (VPNs, Password Managers, and More)
Without going into too much detail, many antiviruses provide tools that aren’t built to detect malware but are nonetheless useful for enhancing your privacy and security. Here’s a short a list of common extra features:
- VPNs. Encrypt your web traffic and allow you to change your IP address. In layman’s terms, a VPN will allow you to keep your online activities private. Operators of the sites you visit, snoopers, and even your ISP will not be able to see what you do online. The best of these will work with streaming services and are backed by no-logs policies, meaning no one stores data about what you do.
- Password Managers. For those of us with lots of accounts spread all over the internet, password managers are a huge convenience and also enhance your security. Most will only require you to memorize one password. Enter it and your other passwords and account names will be automatically filled in whenever you visit the associated site. Naturally, they protect your passwords with top-notch encryption, and the best antivirus-bundled password managers come with other useful features like password sharing, 2FA, and various recovery methods.
- Optimization Tools. Though they won’t enhance your security generally speaking, optimization tools will help you in other ways. They can free up space on your hard drive, increase your performance, and automatically update your apps (which actually will improve your security).
- Secure Browsers. Modern-day browsers are more secure than ever, but the most popular ones still have flaws. Secure browsers come with extra security features and are ideal for protecting yourself while doing sensitive things like online banking and shopping.
- Identity Theft Protections. Many antiviruses offer tools to protect your most sensitive personal information. They will alert you if you’ve been involved in a data breach, scanning the dark web for everything from your passwords to your social security number. If something has leaked online, they’ll guide you through the next steps. Many even offer insurance coverage.
Multi-Device Protection
These days, our phones are more powerful than full-sized computers were a decade ago.
We use them to browse the Internet, message friends, share photos, download media, and more.
If your antivirus doesn’t offer any protection for your Apple or Android device, you’re leaving yourself extremely vulnerable. Luckily, the best antiviruses have great protection for Android and iOS too.
And that’s just a taste of what advanced antivirus software can do. As cybercrime grows and learns to exploit new channels, the top names in antivirus protection continue to add features to their products.
Do I Need an Antivirus?
Antivirus software is a lot like insurance. You hope you never need it, but if you’re ever caught in a crisis without it, you’ll seriously regret not planning ahead.
Pretty much everyone — PC, Mac, and mobile users included — should use some kind of antivirus on their devices. Remember that just one malware attack could leak your personal information onto the black market, steal all of the cash from your bank account, or delete every important file you own.
I recommend using an antivirus with web protection. You probably won’t be surprised to learn that most malware spreads via the internet. Though they’re much better than they used to be, browsers aren’t as good at blocking malicious websites as the best internet security suites. Web protection works similarly to malware scanners, blocking malicious sites using databases and behavior-based detection.
It’s also worth noting that despite browsers now having good security features, new exploits and vulnerabilities are found every single day.
Overall, antivirus technology has come a long way, and it’s had to. The frantic pace of malware evolution has led to some truly amazing innovations in cyber-protection. Today’s cybercriminals are just too vicious — it’s definitely worth exploring antivirus software further and learning about how it can protect you.
Frequently Asked Questions
How do antiviruses work?
In short, antiviruses detect threats by looking for malware signatures and suspicious behavior. The former is pretty basic, while the latter requires advanced machine learning and heuristics that can detect malware based solely on what the file does. This is essential, as antiviruses that only rely on malware databases are completely ineffective against brand-new threats.
Good antiviruses also offer a range of other tools to protect your online security and privacy, such as web protection, VPNs, and more.
Do antiviruses work on phones?
Yes — many antivirus companies do make phone apps (and some are very good). If you want to protect both your computer and your phone, make sure your antivirus has mobile apps and lets you cover more than one device. Note that iOS antiviruses are far more limited than those for Android and don’t perform traditional virus scans.
Do antiviruses work on Macs?
Yes, and some work quite well, blocking threats like malware, phishing sites, and more. Though the software is built differently from Windows antiviruses, at a basic level they work in much the same way. They also offer similar extra features like password managers and VPNs. You can take a look at our recommendations for the best antiviruses for Mac.