Virus scanners work in several ways. The most common is pattern matching, where the scanner looks inside files for a string of bytes which match those in its database of known viruses. This will find the majority of viruses. To detect viruses which use techniques such as polymorphism to change their code slightly each time they infect, scanners also have to use more sophisticated inspection techniques. These include processing files in a real-time emulation mode to watch for the polymorphic engine to decrypt the virus. Most virus-scanner developers constantly improve their scanners to keep up with the growth of viruses and the ever-expanding range of infectable objects to inspect.
For more information on this topic, visit these other searchSecurity resources:
Best Web Links: Malware
David Strom's Security Tool Shed: myCIO.com Virus Scan ASAP
Scheier's Security Product Roundup: Antivirus tools: Unify and conquer
Dig Deeper on Penetration testing, ethical hacking and vulnerability assessments
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.