Antivirus Basics · 7 min read
How Does Antivirus Software Work?
Antivirus detection is a stack of increasingly expensive checks. Cheap checks run first on everything; expensive ones run only on what survives.
Published 2026-08-09 · Last updated 2026-08-09
Step one: reputation and hash lookup
When a file appears, the engine hashes it and asks a cloud service whether that hash is known. Millions of files are resolved this instant — known good, known bad, or unknown. Reputation services also score by prevalence and age: a binary seen on three machines in the last hour is inherently more suspicious than one installed on forty million PCs for six years.
Step two: static analysis
Unknown files get unpacked and inspected without running. The engine looks at imported functions, embedded scripts, obfuscation, digital signatures and structural anomalies. This catches repackaged variants of known families that changed just enough to break the hash.
Step three: emulation and sandboxing
Some engines briefly execute the file in an emulated environment to see what it tries to do before allowing it onto the real system. Cloud sandboxes go further, detonating the sample on vendor infrastructure and returning a verdict in seconds.
Step four: behavioural monitoring at runtime
Once a program is running, the engine watches for malicious patterns: mass file encryption, credential dumping, process injection, deletion of shadow copies, persistence via scheduled tasks. This is where ransomware is usually caught, sometimes after a handful of files have already been touched — which is exactly why backups still matter.
Why false positives happen
Aggressive heuristics that catch new malware also catch unusual legitimate software: installers that self-modify, developer tools, game modding utilities and cracked-looking custom binaries. A product with zero false positives is a product with weak heuristics. If a file you trust is flagged, verify it independently before adding an exclusion.
Frequently asked questions
- How does antivirus detect brand-new malware?
- Through heuristics, cloud reputation scoring and behavioural monitoring rather than signatures, which by definition do not exist yet for a new sample.
- Why do scans take so long?
- A full scan reads and analyses every file on disk. Quick scans check only the locations malware typically uses, which is why they finish in minutes.