What does antivirus software actually do? A plain-English guide

Almost every Windows PC has some kind of antivirus running, but few people know what it's actually doing in the background. Understanding the basics helps you choose the right protection, recognise real alerts from fake ones, and avoid paying for features you don't need.

1. What antivirus is

Antivirus is software that looks for, blocks and removes malicious programs — known together as malware. Despite the name, modern antivirus deals with far more than viruses. It also targets:

• Trojans — programs that pretend to be something useful but do something harmful.
• Ransomware — malware that encrypts your files and demands payment to unlock them.
• Spyware and keyloggers — software that secretly records what you do or type.
• Adware and potentially unwanted programs (PUPs) — software that floods you with ads or changes your browser settings.
• Malicious websites and downloads — many products also check links and downloads before they reach your PC.

2. How antivirus detects threats

No single technique catches everything, so modern products combine several layers.

Signature detection

Every known malware file has identifying patterns — a kind of fingerprint. Antivirus companies collect these into a database of "signatures" and your antivirus compares files against it. This is fast and accurate for known threats, which is why antivirus updates its definitions several times a day.

Heuristic analysis

New malware appears constantly, often with small changes to avoid matching signatures. Heuristics look for suspicious characteristics instead — code that tries to hide itself, or instructions commonly used by malware — so the antivirus can flag files it has never seen before.

Behaviour monitoring

Some threats only reveal themselves when they run. Behaviour monitoring watches what programs do: a program that suddenly starts encrypting hundreds of your documents, or tries to disable security settings, gets stopped even if its file looked harmless.

Cloud reputation

Many products check unfamiliar files against a cloud database built from millions of other users. A file that's brand new and seen on only a handful of computers is treated with more suspicion than one used by millions.

Sandboxing

Some products run a suspicious file in an isolated, sealed-off environment to see what it does before letting it touch the real system.

3. Real-time protection vs scans

• Real-time protection (sometimes called on-access scanning or a "shield") checks files the moment they're opened, downloaded or run. This is the most important part of any antivirus and should always stay on.
• Quick scan checks the places malware most commonly hides, such as startup locations and system folders. It usually takes a few minutes.
• Full scan checks every file on your drives. It can take an hour or more and is useful when you suspect a problem.
• Boot-time or offline scan runs before Windows starts, which helps remove stubborn malware that hides while Windows is running. Microsoft Defender calls this Microsoft Defender Offline scan; AVG and others have similar options.

4. What antivirus can't protect you from

This is the part most advertising leaves out. Antivirus is good at stopping malicious software, but many of today's threats rely on tricking people instead.

• Phishing: If you type your password into a convincing fake login page, the antivirus may not stop you — especially if the page is brand new. Some products and browser tools, such as Guardio, specialise in catching these pages, but none catches them all.
• Phone and tech-support scams: If someone persuades you over the phone to install remote-access software, that software is legitimate, so antivirus usually won't block it.
• Weak or reused passwords: Antivirus can't stop someone logging in with a password leaked from another website.
• Data breaches at companies: If a shop you use is hacked, your details are exposed no matter what's on your PC.
• Unpatched software: Out-of-date Windows, browsers and apps have security holes that attackers can use. Updates matter as much as antivirus.

5. False positives and quarantine

Occasionally antivirus flags a safe file as dangerous — a false positive. It's more common with small, niche or newly released programs.

When antivirus finds a threat, it usually moves the file into quarantine (sometimes called the Virus Vault or Protection history). Quarantined files are locked away and can't run, but they aren't deleted immediately, so a mistake can be undone.

• If you don't recognise the file, leave it in quarantine or delete it.
• Only restore a file if you're certain it's safe — for example, a program you downloaded from the developer's official website. If unsure, upload it to a multi-engine scanning service such as VirusTotal to get a second opinion.

6. Does Windows 11 need extra antivirus?

Windows 11 includes Microsoft Defender Antivirus, which is switched on automatically, updates through Windows Update and provides real-time protection, ransomware protection (Controlled folder access) and SmartScreen download and website checks. For many careful users, it's enough.

A different or extra product can make sense if you want a simpler interface, extra features such as a webcam guard or password manager, protection for several family devices from one account, or stronger scam and phishing protection in the browser. Our AVG vs Guardio vs Defender comparison explains the options.

7. How to judge an antivirus product

• Independent test results: Labs such as AV-TEST, AV-Comparatives and SE Labs regularly test antivirus products for protection, performance and false positives. Look at several recent results rather than one headline award.
• Performance impact: A good product shouldn't make your PC noticeably slower. Try the free version or trial first.
• Privacy: Antivirus sees a lot of your activity. Read what data the company collects and whether you can turn off optional data sharing.
• Honest pricing: Check what the renewal price will be after the first year and how to cancel auto-renewal.
• Pop-ups and upselling: Free versions often promote paid upgrades. Check whether you can reduce these notifications.

Frequently asked questions