Antivirus

In short: Antivirus software (virus protection) detects, blocks and removes malware such as viruses, trojans and ransomware.

In more detail: It runs constantly in the background and checks files when they are opened, downloaded and saved (real-time protection). On Windows, Microsoft Defender provides built-in protection.

In Depth

Detection methods

• Signatures: known malware is recognised by characteristic patterns. The signatures must be updated continuously.
• Heuristics: the code is examined for suspicious properties to find variants too.
• Behaviour analysis: programs are observed, and typical malicious behaviour (e.g. encrypting many files) raises an alarm. This often runs first in a sandbox.
• Cloud lookup: checksums are compared with an online database.

Actions and limits

Files that are found go into quarantine or are deleted. No antivirus detects everything, especially new attacks (zero-day). It replaces neither updates nor caution with attachments and links (phishing). Several virus scanners at the same time interfere with each other.

See also: malware, fake antivirus, firewall