How do I explain how Anti-Virus protection works to a non-Super User?

I just had a client ask me this, and I really couldn't give him a good, simple, easy to understand answer. Best thing I could come up with was that each virus has a specific "fingerprint" and the software scans in known infected areas for them.

 

How do I explain this in a simple easy to understand fashion?

Maybe combined with:

How do anti-viruses work?

So I was thinking about viruses recently, and wondering how exactly antiviruses keep up? Considering anybody who'd been coding for a few weeks could hack together something do do nasty, nasty things to somebody's PC, the quantity alone would make a simple list of hashes prohibitive, so how do antiviruses do it? Do they monitor process activity and have a 3 strikes rule for doing virus-like things? And if so, what's stopping it from triggering on perfectly harmless things (like me moving files around in \system32)?

How do I explain how Anti-Virus protection works to a non-Super User?

I just had a client ask me this, and I really couldn't give him a good, simple, easy to understand answer. Best thing I could come up with was that each virus has a specific "fingerprint" and the software scans in known infected areas for them.

How do I explain this in a simple easy to understand fashion?

Maybe combined with:

How do anti-viruses work?

So I was thinking about viruses recently, and wondering how exactly antiviruses keep up? Considering anybody who'd been coding for a few weeks could hack together something do do nasty, nasty things to somebody's PC, the quantity alone would make a simple list of hashes prohibitive, so how do antiviruses do it? Do they monitor process activity and have a 3 strikes rule for doing virus-like things? And if so, what's stopping it from triggering on perfectly harmless things (like me moving files around in \system32)?

How do I explain how Anti-Virus protection works to a non-Super User?

I just had a client ask me this, and I really couldn't give him a good, simple, easy to understand answer. Best thing I could come up with was that each virus has a specific "fingerprint" and the software scans in known infected areas for them.

How do I explain this in a simple easy to understand fashion?

Maybe combined with:

How do anti-viruses work?

So I was thinking about viruses recently, and wondering how exactly antiviruses keep up? Considering anybody who'd been coding for a few weeks could hack together something do do nasty, nasty things to somebody's PC, the quantity alone would make a simple list of hashes prohibitive, so how do antiviruses do it? Do they monitor process activity and have a 3 strikes rule for doing virus-like things? And if so, what's stopping it from triggering on perfectly harmless things (like me moving files around in \system32)?

How do I explain how Anti-Virus protection works to a non-Super User?

I just had a client ask me this, and I really couldn't give him a good, simple, easy to understand answer. Best thing I could come up with was that each virus has a specific "fingerprint" and the software scans in known infected areas for them.

How do I explain this in a simple easy to understand fashion?

Maybe combined with:

How do anti-viruses work?

So I was thinking about viruses recently, and wondering how exactly antiviruses keep up? Considering anybody who'd been coding for a few weeks could hack together something do do nasty, nasty things to somebody's PC, the quantity alone would make a simple list of hashes prohibitive, so how do antiviruses do it? Do they monitor process activity and have a 3 strikes rule for doing virus-like things? And if so, what's stopping it from triggering on perfectly harmless things (like me moving files around in \system32)?