Anti-malware software uses a scanner to identify programs that are or may be malicious. Scanners can detect:
Known malware: The scanner compares files on your computer against a library of identities for known malware. If it finds a match, it issues an alert and blocks access to the file. Detection of known malware relies on frequent updates to a database of the latest virus identities or connection to a cloud-based malware database.
Previously unknown malware: The scanner analyzes the likely behavior of a program. If it has all the characteristics of a virus, access is blocked, even though the file does not match known viruses.
Suspicious files: The scanner analyzes the likely behavior of a program. If that behavior is considered undesirable, the scanner warns that it may be malware. Most anti-malware packages offer both on-access and on-demand scanners.
On-access scanners stay active on your computer whenever you are using it. They automatically check files as you try to open or run them, and can prevent you from accessing infected files.
On-demand scanners let you start or schedule a scan of specific files or drives.