# What is Antivirus?

> Antivirus is malware-focused software that attempts to detect, block, quarantine, or remove malicious code on a device or at a content-processing point.

- Canonical URL: https://yellowcube.eu/glossary/antivirus/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The historical name is narrower than current implementations, which may address viruses and other malware using signatures, reputation, heuristics, behavior analysis, or cloud-assisted verdicts. Capability varies by operating system, product, configuration, and deployment location.

Antivirus may be built into an operating system, deployed separately, or included in an endpoint protection platform. It can inspect files and may observe scripts, processes, memory, downloads, removable media, or other activity where the platform permits. The software needs timely maintenance.

### Key points

- **Operations:** Define which assets require coverage, keep the engine and detection content current, monitor disabled or unhealthy protection, control exclusions, centralize important events, and test compatibility before changes.
- **Alert handling:** Preserve the detection name, file or process context, affected identity and device, time, and related behavior; validate scope rather than assuming quarantine ended the intrusion.
- **Security and privacy:** Antivirus commonly has extensive device access and may submit suspicious files or metadata for remote analysis; evaluate privileges, update trust, data handling, jurisdiction, and availability impact.
- **Important limitation:** No antivirus method detects all malware or malicious use of legitimate tools. A detection does not establish actor, scope, or impact, while a clean scan does not prove that an endpoint is uncompromised.

### Related terms

[Malware](<https://yellowcube.eu/glossary/malware/>) · [Computer virus](<https://yellowcube.eu/glossary/computer-virus/>) · [Heuristic analysis](<https://yellowcube.eu/glossary/heuristic-analysis/>) · [Endpoint protection platform (EPP)](<https://yellowcube.eu/glossary/endpoint-protection-platform/>) · [Endpoint detection and response (EDR)](<https://yellowcube.eu/glossary/endpoint-detection-and-response/>)

### Sources

[UK National Cyber Security Centre: Antivirus and Other Security Software](https://www.ncsc.gov.uk/collection/device-security-guidance/policies-and-settings/antivirus-and-other-security-software) · [Center for Internet Security Critical Security Control 10: Malware Defenses](https://www.cisecurity.org/controls/malware-defenses) · [NIST glossary: Malware](https://csrc.nist.gov/glossary/term/malware)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.