Antivirus, anti-virus, or AV software is computer software used to prevent, detect and remove malicious computer viruses. Most software described as antivirus also works against other types of malware, such as malicious Browser Helper Objects (BHOs), browser hijackers, ransomware, keyloggers, backdoors, rootkits, trojan horses, worms, malicious LSPs, dialers, fraudtools, adware and spyware.[1] Computer security, including protection from social engineering techniques, is commonly offered in products and services of antivirus software companies.[2] This page discusses the software used for the prevention, detection, and removal of malware threats, rather than computer security implemented by software methods.
A variety of strategies are typically employed. Signature-based detection involves searching for known patterns of data within executable code. However, it is possible for a computer to be infected with new malware for which no signature is yet known; and malware is often modified to change its signature without affecting functionality. To counter such so-called zero-day threats, heuristics can be used. One type of heuristic approach, generic signatures, can identify variants by looking for slight variations of known malicious code in files. Some antivirus software can also predict what a file will do by running it in a sandbox and analyzing what it does to see if it performs any actions which could be malicious.
Antivirus software has some drawbacks. It can impair a computer's performance.[3] Inexperienced users can be lulled into a false sense of security when using the computer, considering themselves to be totally protected, and may have problems understanding the prompts and decisions that antivirus software presents them with. An incorrect decision may lead to a security breach. If the antivirus software employs heuristic detection, it must be fine-tuned to minimize misidentifying harmless software as malicious (false positive).[4] Antivirus software itself usually runs at the highly trusted kernel level of the operating system to allow it access to all the potential malicious process and files, creating a potential avenue of attack.[5]
source:Wikipedia
