Antivirus

Antivirus is software that scans computers, phones and servers for malicious programs, originally computer viruses, and blocks, quarantines or deletes them. A traditional antivirus program checks files against a database of known threats and alerts the user when it finds a match. Today the label covers products that defend against most kinds of harmful software, and it is one of the oldest and most widespread security tools in use.

Antivirus is closely related to anti-malware. The two terms are now often interchangeable, but antivirus came first, built to stop self-copying viruses that spread through floppy disks and email, while anti-malware describes the wider field that also covers spyware, ransomware and newer threats. In finance, antivirus protection is a basic requirement for systems handling customer data and payments.

An antivirus program works like a doctor checking patients against a list of known illnesses. Each harmful program leaves recognisable traces, and the antivirus keeps a long list of those traces, updated every day. When a file comes in, it is checked against the list, and anything matching a known illness is isolated before it can spread.

The weakness is that a doctor working only from a list will miss a brand-new illness. Modern antivirus tools try to spot unfamiliar threats by watching for strange behaviour, but the list-checking idea is still at the heart of how they work.

Experimental self-replicating programs appeared in the early 1970s, including a program called Creeper on the ARPANET and a follow-up, Reaper, written to remove it, sometimes described as the first antivirus. Viruses spreading in the wild appeared in the early 1980s on personal computers; Brain, released in 1986, is often cited as the first virus for IBM-compatible PCs. Commercial antivirus companies emerged in the late 1980s, and products from McAfee, Symantec, Sophos, Kaspersky and others became standard on business and home computers through the 1990s. Email worms such as ILOVEYOU in 2000 showed how quickly malware could spread worldwide. Microsoft later built antivirus protection into Windows, now known as Microsoft Defender, making basic protection a default feature rather than a separate purchase.

• Signatures. Each known threat is identified by byte patterns or a hash of the file; the program compares files against these.
• Scanning modes. On-access scanning checks files when they are opened or downloaded; scheduled scans check the whole system.
• Heuristics. Rules that flag suspicious code structures, such as packed or obfuscated programs.
• Behaviour blocking. Monitoring programs as they run and stopping harmful actions.
• Cloud lookups. Sending file fingerprints to the vendor's servers for an up-to-date verdict.
• Code signing checks. Trusting software signed with a valid digital signature from a known publisher more than unsigned files.

Security professionals use the harmless EICAR test file, recognised by most products, to check that antivirus is active without using real malware.

Banks, payment companies and merchants are required by standards such as the Payment Card Industry Data Security Standard to run up-to-date anti-malware protection on systems that handle card data. Antivirus helps protect against malware that enables identity theft, credential theft and fraud. For crypto users, it can catch common wallet-stealing programs, malicious browser extensions and hidden mining software that uses a computer's power for crypto mining without permission, a practice known as cryptojacking. It is also part of the evidence that firms have taken reasonable steps to prevent a data breach.

Signature-based antivirus is reactive: it detects threats only after they have been identified and added to the database, so new or custom malware can slip through. Attackers routinely change their code to avoid known signatures. Some malware disables or hides from security software, and a few antivirus products have themselves contained vulnerabilities or collected more data than users expected. Antivirus also cannot stop phishing attacks that trick users into giving away passwords or approving payments. For these reasons, organisations now treat antivirus as a baseline layer combined with patching, two-factor authentication, backups and monitoring, rather than a complete defence.