Security – How do anti-viruses work?

So I was thinking about viruses recently, and wondering how exactly antiviruses keep up?Considering anybody who’d been coding for a few weeks could hack together something do do nasty, nasty things to somebody’s PC, the quantity alone would make a simple list of hashes prohibitive, so how do antiviruses do it? Do they monitor process activity and have a 3 strikes rule for doing virus-like things? And if so, what’s stopping it from triggering on perfectly harmless things (like me moving files around in system32)?

I did a bit of googling, but the regular places didn’t particularly help, and I couldn’t find a dupe here, so I thought it’d be good to ask 🙂

Solution:

This article from 2002 talks about building an antivirus engine.

 

The article will describe the basic  ideas, concepts, components and  approaches involved in developing an  anti-virus program from scratch from a  developer’s/software engineer’s point  of view. It will focus on the main  elements of an anti-virus engine  (hereafter referred to as AV engine)  and will exclude aspects like  graphical user interfaces, real-time  monitors, file system drivers and  plug-ins for certain application  software like Microsoft Exchange or  Microsoft Office. Although AV engines  running/scanning for single platforms  (such as Palm OS or EPOC/Symbian OS)  can be designed in the same way, this  article will focus on designing  multi-platform scanning engines, which  are far more complex.

There’s also an article on heuristic techniques to detect infections. It’s also an interesting read.