Page "Antivirus software" Paragraph 1

A variety of strategies are typically employed.

Signature-based detection involves searching for known patterns of data within executable code.

However, it is possible for a computer to be infected with new malware for which no signature is yet known.

To counter such so-called zero-day threats, heuristics can be used.

One type of heuristic approach, generic signatures, can identify new viruses or variants of existing viruses by looking for known malicious code, or slight variations of such code, in files.

Some antivirus software can also predict what a file will do by running it in a sandbox and analyzing what it does to see if it performs any malicious actions.