Antivirus software is an endpoint security program that detects, blocks and removes malicious software on computers, servers and mobile devices. In infrastructure defense it forms the baseline layer of endpoint protection, inspecting files, memory and process behavior to stop known and many unknown threats before they execute or spread.
The name dates from the era of self-replicating viruses, but modern antivirus, often marketed as an endpoint protection platform or next-generation antivirus, addresses the whole malware spectrum: ransomware, trojans, worms, spyware, infostealers and potentially unwanted programs. It is primarily a prevention tool, which distinguishes it from EDR, whose strength lies in detection, investigation and response.
How antivirus software detects malware
Antivirus software combines several detection techniques, because each catches threats that the others miss. Files are typically examined when they are written, opened or executed, which is called on-access or real-time scanning, and periodically through scheduled full scans.
| Technique | How it works | Strength | Weakness |
|---|---|---|---|
| Signature matching | Compares hashes and byte patterns with a database of known malware | Fast, very few false positives | Misses new and modified samples |
| Heuristic analysis | Scores suspicious code structures and instructions | Catches variants of known families | More false positives |
| Behavior monitoring | Watches actions such as mass file encryption or process injection | Detects unknown malware at run time | Reacts after execution begins |
| Machine learning models | Classifies files by learned features before execution | Good at new samples | Can be evaded by adversarial techniques |
| Cloud reputation | Queries global prevalence and verdicts for a file hash | Rapid updates across all clients | Depends on connectivity |
| Sandboxing | Runs suspicious files in an isolated environment | Reveals hidden behavior | Slow, can be detected by malware |
On Windows, antivirus engines integrate with the operating system through file system minifilter drivers, kernel callbacks and the Antimalware Scan Interface, which lets the engine inspect deobfuscated scripts in PowerShell, VBScript and Office macros at the moment they run.
Responses and key configuration settings
When a threat is found, antivirus software applies a configured action: block execution, quarantine the file, attempt to clean it or delete it. Quarantine moves the file into an encrypted, non-executable store so it can be restored if the detection proves to be a false positive.
| Setting | Recommended value | Reason |
|---|---|---|
| Real-time protection | Always on | Most infections occur between scheduled scans |
| Cloud-delivered protection | Enabled with automatic sample submission policy | Faster verdicts for new threats |
| Signature updates | Several times per day | Reduces exposure to recently identified malware |
| Tamper protection | Enabled | Prevents malware or users from disabling the agent |
| Exclusions | Minimal and specific paths only | Broad exclusions are abused by attackers |
| Potentially unwanted applications | Block | Stops adware and bundled tools |
| Scheduled full scan | Weekly, outside working hours | Finds dormant files missed by real-time checks |
Exclusions are the most dangerous setting. Administrators often exclude entire folders to fix performance issues with databases or build systems, and attackers who discover these paths drop their tools there. Exclusions should name specific processes or files and be reviewed regularly.
Antivirus compared with EDR and other defenses
Antivirus software is one layer among several infrastructure defense controls, and its role is often misunderstood. The comparison below shows how it relates to its neighbors.
| Control | Main goal | Visibility | Typical response |
|---|---|---|---|
| Antivirus software | Prevent malware execution | Files and process behavior on one device | Block and quarantine |
| EDR | Detect and investigate attacker activity | Detailed endpoint telemetry over time | Isolate host, kill process, hunt |
| XDR | Correlate signals across layers | Endpoints, email, identity, network | Coordinated response |
| Application allowlisting | Run only approved software | Execution attempts | Deny unknown programs |
| Firewall | Control network traffic | Connections and ports | Allow or block traffic |
| Secure email gateway | Stop malicious mail | Messages and attachments | Quarantine messages |
Modern products frequently bundle antivirus and EDR in one agent. In such cases the antivirus engine handles prevention while the EDR component records activity for analysts, often supported by an MDR service that monitors alerts around the clock.
Limitations and evasion techniques
Antivirus software cannot stop every attack, and treating it as sufficient is a common error. Skilled attackers test their tools against popular engines before use and choose techniques that leave little for a scanner to inspect.
- Fileless attacks run code in memory through legitimate tools such as PowerShell or WMI.
- Living-off-the-land uses built-in system binaries that antivirus must trust.
- Packing, encryption and polymorphism change file signatures with every build.
- Attackers with administrative rights may disable or uninstall the agent, sometimes using vulnerable signed drivers.
- Stolen credentials let attackers act without any malware at all.
False positives are the opposite problem. An overly aggressive engine can quarantine legitimate business software, and a faulty signature update can disrupt thousands of machines at once. Staged deployment of updates to test groups reduces this risk in larger organizations.
Antivirus on Linux, macOS and servers
Antivirus is not limited to Windows desktops. Linux file and mail servers often run engines such as ClamAV to scan files shared with Windows clients, and enterprise agents now support Linux workloads using kernel interfaces such as fanotify and eBPF. macOS includes built-in malware protection, and organizations frequently add a managed agent for central reporting and policy control.
On servers, the key concern is performance and stability. High-throughput databases, virtualization hosts and container nodes require carefully tested exclusions and vendor-supported configurations rather than default desktop policies.
In plain words
Antivirus software works like a security guard at the entrance of a computer. It checks every file and program that tries to come in or run, compares it with a list of known troublemakers and watches for suspicious behavior, such as a program suddenly locking all documents.
When it finds something dangerous, it stops the program and locks it away so it cannot cause harm. It is an essential first layer of protection, but like any guard it can be fooled, so it works best alongside other safeguards.
A real-world example
An accountant at a 40-person architecture firm opens an email attachment that looks like a supplier invoice. When the attached document launches a hidden PowerShell script, the antivirus behavior monitor detects an attempt to download and run code in memory. It terminates the process, quarantines the document and sends an alert to the firm’s managed IT provider.
The provider reviews the alert, confirms that cloud reputation identified the payload as a known infostealer and checks that no other machine received the same file. No data was stolen and no system needed rebuilding. As a follow-up, the firm enables tamper protection on all endpoints and removes a broad folder exclusion that an earlier software installation had added.