A virus scanner is an anti-virus program( AV) that scans files forviruses, worms and Trojans, detects them and removes them if possible. Virus scanners are usually activated automatically when logging in and check whether the hard disk and the main memory are infected by viruses. These scanners are called on-demand scanners, as opposed to on-access scanners, which work in the background and check all actions.
The most important functional unit of a virus scanner is the engine. It receives the infected or suspicious file after the file type is detected and the file is unpacked. Then, the virus signature of the malware is identified with detection routines. These detection routines contain the typical characteristics of the virus family. Since the diagnosis of all files is very time-consuming, antivirus programs check the beginning and the end of the files, because viruses usually attach themselves to them. If the antivirus detects a virus, it either directly triggers a virus cleaner that removes the virus or it displays the corresponding file.
Among virus scanners, a distinction is made between those that work permanently in the background, such as Windows Defender, these are the on-access scanners, and those that scan for viruses on demand, these are the on-demand scanners. As for the real-time scanners or on-access scanners, also known as virus checkers, they work permanently as a background program and check all actions and files for malware. If malware is detected, it is displayed. In the second group, on-demand scanners, virus scanning is performed manually on demand or as online scanners, which are downloaded from the network on demand.
Virus scanners work with search engines and databases, the quality of which determines the detection of infected files. The known ITW viruses are stored in thedatabase. In the case of a new virus, a virus scanner cannot become active until it knows its structure. By updating existing virus scanners, only then can the fight against new viruses take place.