thumb|right|ClamTk 3.08 free antivirus software running on Ubuntu 8.04 Hardy Heron

Antivirus software mainly prevent and remove computer viruses, including worms and trojan horses. Such programs may also detect and remove adware, spyware, and other forms of malware.

A variety of strategies are typically employed. Signatures involve searching for known malicious patterns in executable code. However, signatures can only be updated as viruses are created; users can be infected in the time it takes to create and distribute a signature. To counter such zero-day viruses, heuristics may be used to essentially guess if the file is truly malicious. Generic signatures look for known malicious code and use wild cards to identify variants of a single virus. An antivirus may also emulate a program in a sandbox, monitoring for malicious behavior. Success depends on striking a balance between false positive and false negatives. False positives can be as destructive as false negatives. In one case a faulty virus signature issued by Symantec mistakenly removed essential operating system files, leaving thousands of PCs unable to boot.

Anti-virus software can have drawbacks. If it is of the type that scans continously, antivirus software may cause a significant decline in computer performance, it may present computer users with a decision the user may not understand. Antivirus software generally works at the highly trusted kernel level of the operating system, creating a potential avenue of attack

The effectiveness of antivirus software is a contentious issue. One study found that the detection success of major antivirus software dropped over a one-year period.Fact: date=April 2009

History

There are competing claims for the innovator of the first antivirus product. Possibly the first publicly-documented neutralisation of a computer virus in the wild was performed by Bernt Fix in 1987.

thumb|right|ClamTk 4.08 virus scanner running on Ubuntu 9.04 An antivirus program to counter the Polish MKS_vir was released in 1987. Dr. Solomon's Anti-Virus Toolkit, AIDSTEST and AntiVir were released by in 1988. By late 1990, nineteen separate antivirus products were available including Norton AntiVirus and McAfee VirusScan.Fact: date=April 2009

Peter Tippett, an emergency-room doctor who also ran a computer software company, made a number of contributions to the budding field of virus detection. He had read an article about the Lehigh virus and questioned whether, from an epidemiological viewpoint, they would have similar characteristics to biological viruses. The IBM compatible computers had various vulnerabilities. The boot sector was affected by the Brain virus, and within IBM DOS and MS-DOS, executable files, with either EXE filename extension or COM file extension, were affected by the Jerusalem virus) and the Lehigh virus specifically targeted .com files. Tippett's company Certus International Corp. then began to sell anti-virus software programs. The company was sold in 1992 to Symantec Corp and Tippett went to work for them, incorporating the software he had developed into Symantec's product, Norton AntiVirus.Fact: date=February 2007