Take the 2-minute tour ×

How do anti-virus programs detect if something is a virus or trojan?

I'm from Turkey, please keep the English simple if possible, thanks.

share|improve this question
I took a shot at it, tell me if I accidentally changed your question. –  GManNickG Sep 8 '09 at 21:34
simple.wikipedia.org/wiki/… may be of use to anyone who wants to answer this question. –  derobert Sep 8 '09 at 21:41
add comment

5 Answers 5

up vote 7 down vote accepted

There are three basic ways to find viruses. You can scan files to see if they have virus code in them from known viruses. You can scan files to see if the code will do virus-like things. You can wait until a program does something it should not do, and flag the program as infected.

You would scan files when they are first created, and you would also do it on a schedule after that. You would have to install a kernel driver in order to watch what programs do and stop them from doing malicious things.

Many anti-spyware programs work exactly the same way. For example, Spybot S&D can watch for Registry changes that could be spyware installations.

share|improve this answer
add comment

There are different types of virus detection. Some of the different techniques they use are

1) Look at binary makeup of file for match or partial match in database of known viruses and trojans (most common technique)

2) Watch what program does and see if it ever does anything similar to viruses/trojans

3) Analyze program code (sometimes disassemble program code) and look for malicious things. This is often very difficult and usually only advanced detection programs do this.

share|improve this answer
3 is very slow too :) –  lfaraone Sep 8 '09 at 21:41
add comment


the first link was pretty good:

  • virus dictionary - looks for known signatures, for example the UPX executable compression algorithm is popular to make the payload really small.
  • suspicious behavior - detects things that don't happen in everyday work, like writing to another executable.
share|improve this answer
Although it gives a good answer, linking to Google is often considered poor etiquette on SO. Just an FYI since I've been downvoted before for doing this. –  Jacob Adams Sep 8 '09 at 21:42
I wouldn't downvote over something so trivial, but there is a point: Google rankings shift. The article Dustin referenced is at antivirusworld.com/articles/antivirus.php –  Steven Sudit Sep 8 '09 at 21:49
add comment

They use signatures, or definitions of what a virus looks like, and compares them to files it scans.

See this article from SciAm for a good explanation.

share|improve this answer
There's also heuristic scanning and behaviorial scanning, at least in any decent modern AV. –  Joe Sep 8 '09 at 22:51
add comment

Antiviruses find viruses by watching the registry, looking at a program's code, looking at it's list of common viruses, or even looking on the internet to see if other people/software have classified it as a virus.

share|improve this answer
add comment

Your Answer

