Software that searches for known viruses. Also known as a "virus scanner." As new viruses are discovered by the antivirus vendor, their binary patterns are added to a signature database that is downloaded periodically to the user's antivirus program via the Web. See virus, quarantine, disinfect and behavior blocking.

Two Different Approaches
Virus scanners work two ways. The more common method scans the file against all known viruses each time the file is opened. The second method, such as used by the Sophos antivirus program, takes a blueprint of every file ahead of time. It computes a checksum of each file's contents and stores it in a database. The next time a file is opened, the software recomputes the checksum and compares it to the one in the database to see if the file has changed. If it has, the program scans the file for viruses. If not, the file is considered virus free. Since most files are virus free, this method is faster because recomputing a checksum is considerably faster than comparing the file with all the binary signatures. See Sophos and checksum.