Ask the Expert

How a virus scanner works

How does a virus scanner work?

    Requires Free Membership to View

Virus scanners work in several ways. The most common is pattern matching, where the scanner looks inside files for a string of bytes which match those in its database of known viruses. This will find the majority of viruses.

To detect viruses which use techniques such as polymorphism to change their code slightly each time they infect, scanners also have to use more sophisticated inspection techniques. These include processing files in a real-time emulation mode to watch for the polymorphic engine to decrypt the virus.

Most virus-scanner developers constantly improve their scanners to keep up with the growth of viruses and the ever-expanding range of infectable objects to inspect.

For more information on this topic, visit these other searchSecurity resources:
Best Web Links: Malware
David Strom's Security Tool Shed: Virus Scan ASAP
Scheier's Security Product Roundup: Antivirus tools: Unify and conquer

This was first published in January 2002

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: