How antivirus software works

Signature matching: fast, precise, always slightly behind

The oldest technique is also the cheapest to run. Security vendors collect malicious files, compute a compact identifier for each one — historically a hash, now more often a pattern that matches a family of related files — and ship those identifiers to installed software as an update. When a file arrives on your machine, the scanner compares it against the list.

The strength of this approach is precision. A match against a known sample is close to certain, so signature detections produce very few false alarms and can be acted on immediately. The weakness follows directly: a file that nobody has collected and analysed yet has no signature, so it does not match. Malicious software is also frequently repackaged specifically to change its identifier while leaving its behaviour intact, which is why signature lists are updated many times a day rather than weekly.

This is the reason an antivirus product that has not updated in a month is substantially less useful than the same product updated this morning. If you take one operational point from this page, it is that automatic updates matter more than which product you chose.

Behavioural detection: catches the unknown, argues with the innocent

Because signatures cannot describe a file nobody has seen, products also watch what programs do once they are running. A process that begins encrypting large numbers of documents in quick succession, or that writes itself into the list of programs that start with the computer, or that injects code into another running program, is doing something that legitimate software rarely does. Behavioural detection — often labelled heuristic analysis, or given a vendor-specific name — intervenes at that point.

This is how genuinely new threats are caught, and it is the part of the product that differentiates one vendor from another most meaningfully. It is also the source of nearly every false alarm. Backup tools read enormous numbers of files. Installers write to startup locations. Developer tools and older niche software do all sorts of unusual things for legitimate reasons. When your scanner objects to a program you trust, behavioural detection is usually why.

A product that intervenes too eagerly trains you to click past its warnings, which is worse than one that intervenes slightly less often. When evaluating a product in a trial period, pay more attention to how often it interrupts you about software you know is fine than to the number of features on its page.

Web and link filtering: a list, checked quickly

The third technique never looks at a file at all. When you follow a link, the software checks the destination against a list of addresses associated with scams, credential harvesting or malicious downloads, and blocks the page if it matches. This is usually delivered as a browser extension, which is why installing a security suite often prompts you to add one.

Modern browsers already perform a version of this check using their own lists, so the question for a paid product is not whether it filters but what its list adds to the one your browser already uses. That is genuinely hard to answer from outside, and it is one of several areas where an honest guide has to say that the comparison cannot be made from the marketing material alone.

Filtering of this kind is aimed at the category of harm that most often costs Australians money. The National Anti-Scam Centre publishes current examples through Scamwatch, and reading a handful of them is a better use of ten minutes than reading any feature list, because it shows you what the messages actually look like.

The three methods compared

Quarantine, and why deletion is not the default

When something is detected, most products do not delete it. They move it to quarantine: a storage area where the file is kept in a form that cannot execute, pending your decision. This exists because of the false alarm problem. If your scanner is wrong about a file, quarantine is recoverable and deletion is not.

The practical habit worth forming is to look at quarantine when something you expected to work stops working. A document that has vanished, a program that will not launch, a printer utility that suddenly fails — these are sometimes a quarantine event rather than a fault. Most products let you restore a file and add an exception, and doing so deliberately is much better than switching the whole product off in frustration, which is what people tend to do instead.

Real-time scanning against scheduled scans

Real-time scanning inspects files as they are opened, written or downloaded. A scheduled scan works through the whole disk on a timetable. Real-time is the one that matters, because it acts at the moment something arrives rather than hours later; full scans are mainly useful after an incident, or after a period when the software was switched off.

Both cost performance. A scanner reads a great deal of data and uses processor time to do it, and on an older machine with a mechanical hard drive the difference is noticeable. If a computer became slow shortly after a security product was installed, that connection is worth investigating before assuming a fault, and scheduling full scans for a time when the machine is idle usually resolves the worst of it.

What antivirus software does not do

It does not undo a payment. If someone has been persuaded to transfer money or hand over card details, the response is the bank and a report to the relevant service, not software. It does not recover an account taken over through a reused password; that is what unique passwords and multi-factor authentication address. It does not protect data from being lost, which is the job of backups. And it does not make a device on which the owner deliberately installs something harmful safe, because at that point the software is being told the action is wanted.

The Australian Cyber Security Centre sets out the measures that sit alongside a security product — keeping software updated, backing up, using multi-factor authentication and using unique passphrases — in its guidance for individuals and families. Those measures are free, and on most reasonable assessments they matter more than the choice between one subscription and another.

What this means for choosing a product

If the methods are broadly shared across the category, the differences between products lie elsewhere: how often the lists update, how noisy the behavioural engine is on your particular software, how much the scanner slows your particular machine, what a licence covers, what support exists, and what the renewal costs. Those are the things the comparison method is built around, and they are the things a feature list is least likely to tell you.

The buying guide puts this into a sequence, and the TotalAV overview shows what answering those questions looks like for one specific product.