How Does My Computer’s Anti-Virus Scanner Work?

Before getting into how anti-virus software works, let’s take a look at just what a virus is. A simple answer to that would be any self-replicating code introduced into a computer’s programming from an outside source without the user’s knowledge or consent. Generally, this code will then attempt to spread the “infection” to other computers, either through network or Internet connections, or via email, sending itself to email addresses found in the user’s contact list. There are many other types of malicious programs, such as trojans, spyware, adware and worms. All together these programs are called malware. A large and still growing segment of the computer software industry is geared toward detecting and eliminating this malware from computer systems.
What these companies do is to collect, isolate and analyze this malware. They look for a “signature”, a bit of code that distinguishes the malware program from the “good” files they attach themselves to. They then incorporate that information into a database to be used by the anti-virus software to detect and eliminate the unwanted code. Most anti-virus scanners you get for your computer these days fights all kinds of malware, and the definitions are updated automatically via the Internet.
What happens when you activate your computer’s anti-virus scanner is that the program scans through the types of programs that viruses and other malware infect, looking for that signature. When one is detected, the scanner does a second test, called an integrity check, to verify the virus’ presence. This minimizes the number of “false positive” results that plagued early anti-virus scanners. Once the virus is confirmed, in most scanners, what’s called an activity blocker then stops whatever behavior the virus calls the computer to perform. Most often, that behavior is the virus’ attempt to transmit a copy of itself to other machines, though some also attempt to damage various files on your computer. Finally, the virus code is removed and the original useful file is restored to its previous state.
Most anti-virus programs allow the user to schedule scans at regular intervals. It is a good idea to set that up for at least once per week.