Problem solve Get help with specific problems with your technologies, process and projects.

How a virus scanner works

How does a virus scanner work?
Virus scanners work in several ways. The most common is pattern matching, where the scanner looks inside files for a string of bytes which match those in its database of known viruses. This will find the majority of viruses.

To detect viruses which use techniques such as polymorphism to change their code slightly each time they infect, scanners also have to use more sophisticated inspection techniques. These include processing files in a real-time emulation mode to watch for the polymorphic engine to decrypt the virus.

Most virus-scanner developers constantly improve their scanners to keep up with the growth of viruses and the ever-expanding range of infectable objects to inspect.

For more information on this topic, visit these other searchSecurity resources:
Best Web Links: Malware
David Strom's Security Tool Shed: myCIO.com Virus Scan ASAP
Scheier's Security Product Roundup: Antivirus tools: Unify and conquer

This was last published in January 2002

Dig Deeper on Penetration testing, ethical hacking and vulnerability assessments