How antivirus software actually works

Part of the 2026 edition · Last reviewed 21 September 2026

Product pages describe detection in language designed to be reassuring rather than informative. The mechanisms underneath are not especially mysterious, and understanding them makes the difference between buying a subscription because it sounds protective and buying one because it does something your device does not already do.

Four ways software decides that a file is malicious

Every consumer product combines the same small set of techniques. They differ in weighting, in the quality of the data behind them, and in how aggressively each is tuned, but the techniques themselves are common property.

Signature matching

The oldest method and still the cheapest. A vendor extracts a distinctive pattern from a known piece of malware — a sequence of bytes, a hash of a file, a structural fingerprint — and distributes it to installed products. The scanner compares what it finds against that list. Signature matching is fast, produces very few false alarms, and is completely useless against anything not yet on the list, which is why the list is updated many times a day and why an unpatched product loses value quickly.

Heuristic analysis

Rather than matching a known sample, heuristics look for the characteristics of malicious code: instructions that rewrite the program's own body, packing and obfuscation that serves no legitimate purpose, requests for privileges a program of that type has no reason to want. Heuristics catch variants that signatures miss, at the cost of occasionally flagging unusual but legitimate software — a trade-off with no perfect setting.

Behavioural monitoring

The most consequential modern technique. Instead of judging a file, the product watches what a running process does: whether it starts encrypting documents in bulk, injects itself into another process, adds itself to the list of programs that start with the computer, or opens a connection to an address associated with command-and-control traffic. Because it judges actions rather than appearance, behavioural monitoring can stop malware never seen before. Because legitimate software sometimes does unusual things, it is also the component most likely to interrupt something harmless.

Reputation and cloud lookup

When a file arrives, the product asks the vendor's service what is known about it — how many other installations have seen it, how old it is, whether it is signed and by whom. A signed installer distributed to millions of machines is treated differently from an unsigned executable first seen eleven minutes ago. This requires the product to send information about files on your device to the vendor, which is one reason the vendor's privacy documentation deserves reading.

When inspection happens

The second axis is timing, and it matters more to the everyday experience of using a computer than the detection method does.

Real-time, or on-access, protection

A system-level component inspects files as they are created, opened, copied or executed. Nothing gets a free pass, but every file operation pays a small tax, which is where the reputation for slowing computers down originates.

Scheduled scanning

A full pass across storage at a set time. Thorough, resource-hungry, and of limited value on a machine that already has real-time protection — its main use is catching something that arrived before the current definitions existed.

On-demand scanning

A scan you start yourself, usually against a specific file or folder. The sensible use is checking a download or an external drive before opening it.

Boot-time and offline scanning

A scan run before the operating system fully loads, used against malware that hides from inspection while the system is running.

What happens to something the product flags

1. The action is blocked

   The file is prevented from executing, or the process is stopped mid-action. Nothing is deleted yet.

2. The file is quarantined

   It is moved to an isolated store where it cannot run, usually encrypted or otherwise neutralised. Quarantine exists because detection is not infallible: a wrongly flagged file can be restored, whereas a deleted one cannot.

3. You are notified

   A notification names the detection. The name is often generic — a family name, or a heuristic label — and tells you less than the wording implies.

4. You decide

   Leave it quarantined, restore it, or delete it permanently. Unless you know precisely what the file is and why it was flagged, leaving it quarantined is the low-risk option.

False positives, and why they matter

A false positive is a legitimate file treated as malicious. They are unavoidable in any system using heuristics or behavioural rules, and they cause more practical damage than their reputation suggests: a blocked business tool, a quarantined system file, an installer that will not run. The more serious harm is behavioural — a reader who has dismissed several false alarms is a reader trained to dismiss the real one.

If a file you trust is flagged, the sequence is to leave it in quarantine, check whether you obtained it from the publisher's own source, and report it to the security vendor as a suspected false positive. Turning protection off to make the warning stop is the one response worth avoiding.

The things antivirus software does not do

This is the part product pages are quietest about, and it is the part that decides whether a subscription is worth buying.

• It does not stop you being persuaded. A convincing phone call, message or email that leads you to approve a payment or hand over a code involves no malicious file at all. Nothing is scanned because nothing is downloaded. This is the dominant form of loss for Australian households, and Scamwatch is the relevant national resource.
• It does not protect an account you have already lost. Once credentials are in someone else's hands, the attack happens on the service's servers. Multi-factor authentication addresses that; a scanner does not.
• It does not patch your software. Malware frequently arrives through a known flaw in an unpatched application. Keeping systems and applications updated is a separate discipline, and the Australian Cyber Security Centre publishes current guidance on it.
• It does not recover your data. If ransomware runs to completion, the only reliable restoration is a backup kept offline or otherwise out of the reach of the infected machine.
• It does not make you anonymous. Anti-malware and privacy are separate problems, whatever a bundle's marketing suggests.

Where this leaves the buying decision

Knowing the mechanisms turns a vague question into a specific one. Instead of "is this product good", the question becomes: which of these layers is already running on my device, which of them would the paid product add, and is the addition worth a recurring cost to me. The by-device pages answer the first half platform by platform, and the decision guide works through the second.