Antivirus Basics · 6 min read
What Is Antivirus Software?
Antivirus software is a program that inspects files, processes and network activity on your device, compares what it sees against known-bad patterns and suspicious behaviour, and blocks or quarantines anything it judges to be malicious.
The name is a historical accident. Modern products stop far more than viruses: trojans, ransomware, spyware, adware, worms, scripts, phishing pages and unwanted programs are all in scope.
Published 2026-08-09 · Last updated 2026-08-09
The three layers inside every modern product
Signature matching compares a file's fingerprint against a database of known malware. It is fast and precise but useless against samples nobody has catalogued yet.
Heuristics and static analysis look at a file's structure — packed code, suspicious API imports, unusual entropy — to guess intent without needing an exact match.
Behavioural monitoring watches what a program does once it runs: encrypting many files quickly, injecting into another process, disabling recovery points. This is the layer that catches genuinely novel attacks, and it is why a product that only claims a large signature database is selling you 2005 technology.
Real-time protection vs on-demand scanning
Real-time protection is resident: it hooks into the file system and intercepts a file at the moment it is written, opened or executed. On-demand scanning is something you trigger manually.
This distinction decides whether a product is protecting you or merely cleaning up afterwards. The free version of Malwarebytes, for example, is on-demand only, while Microsoft Defender and Bitdefender's free edition are resident.
What antivirus cannot do
It cannot fix an unpatched operating system, stop you typing your password into a convincing fake login page, recover files you never backed up, or protect an account whose password you reused across ten sites. Antivirus is one control among several, not a force field.
Frequently asked questions
- Is antivirus still necessary?
- Yes, but on Windows you already have it. The question is whether you keep Microsoft Defender or replace it with a third-party product.
- Does antivirus stop phishing?
- Partly. Most suites block known phishing URLs, but a brand-new page can slip through. Your own scepticism is the primary control.