Knowledge base · Antivirus software
Antivirus software, explained entry by entry
A reference site about one narrow subject: the software that scans computers and phones for malicious files and behaviour. Each entry defines a concept, shows how it works in practice, and points to the Australian bodies publishing independent guidance.
Start where you are
New to the subject: what antivirus software is. Weighing a purchase: comparing antivirus products. Looking up a word: the glossary.
How this site is paid for
Momentum Space carries advertising links. When a reader follows the Surfshark Antivirus link on this site and buys a subscription, Surfshark pays this publisher a share of that sale. Nothing is added to the reader's price, and we never charge a reader anything.
Surfshark is the only vendor this publisher has such an arrangement with, which is why it is the only product described in detail here. That shapes what is covered, so it is stated at the top rather than in the small print. The affiliate disclosure page sets out the whole arrangement.
The entries
Eight entries, meant to be read in any order and cross-linked where a term needs a fuller definition.
- What antivirus software is
The three jobs a scanner performs, what belongs to the operating system instead, and the limits of the category.
- Malware types, defined
Viruses, worms, trojans, ransomware, stealers and unwanted programs, and why the labels overlap.
- How detection works
Signatures, heuristics, behavioural monitoring, sandboxing and cloud lookups, plus what a false positive costs.
- Coverage by operating system
Windows, macOS, Linux, Android and iOS handle security differently, and the differences decide what a security app can do at all.
- Scanning and privacy
What a scanner reads, what leaves the device, and how the Australian Privacy Principles apply.
- Comparing antivirus products
A method for evaluating a purchase, including subscription terms and consumer guarantees.
- Glossary
About forty terms defined in a sentence or two, cross-linked to the entry that explains each one.
- Entry: Surfshark Antivirus
The product this site links to, described from what the vendor and the referral programme state.
The category in one page
Antivirus software inspects files, memory and program behaviour, compares what it finds against a definition of harm, and acts on matches: blocking them, moving them to quarantine, or reporting them for a person to decide. Everything else sold under the name is an addition to that core.
The name has outlived its accuracy. Self-replicating file viruses are now a small share of what scanners look for; the bulk is trojans, ransomware, information stealers, and programs installed without a clear choice. Malware types, defined separates them.
A second shift matters more for buyers. Every mainstream operating system ships with security built in: Microsoft Defender Antivirus on Windows, XProtect and Gatekeeper on macOS, Google Play Protect on Android, and on iOS a sandbox that stops any app, a security app included, from reading another app's files. The Australian Cyber Security Centre publishes device guidance at cyber.gov.au, and its advice treats patching, backups and multi-factor authentication as the load-bearing controls. A purchased scanner sits alongside those. Coverage by operating system works through what each platform already includes.
The practical question is therefore narrower than whether antivirus is needed: what does a paid product add to what this device already does, on the platforms I use? That is the spine of comparing antivirus products.
Four terms worth knowing before the rest
These recur across every entry; the glossary holds the longer list.
- Signature
- An exact identifier for a known piece of malware, from a file hash to a byte pattern. Fast and precise, and blind to anything not yet analysed.
- Heuristic
- A rule that judges a file by its characteristics rather than a known identity, so something never seen before can still be flagged. Heuristics generalise, which is why they also misfire.
- Behavioural monitoring
- Judging a running program by what it does rather than what its file contains, such as rapidly rewriting many documents.
- False positive
- A clean file identified as malicious. It interrupts work and trains people to dismiss warnings.
What changes between operating systems
The same product does very different work depending on where it is installed. A licence covering five devices does not deliver the same function on each.
| Platform | Built in by the vendor | What a security app can add |
|---|---|---|
| Windows | Microsoft Defender Antivirus, SmartScreen, controlled folder access | A full alternative engine, since Windows lets a third-party product take over real-time scanning |
| macOS | XProtect, Gatekeeper, notarisation checks, system integrity protection | Wider scanning than Apple's list covers, including Windows malware passing through shared storage |
| Linux | Package signing and repository trust, discretionary and mandatory access controls | Scanning of files the machine serves to other systems, the usual reason a scanner runs there |
| Android | Google Play Protect, per-app permissions, app sandboxing | Scanning of apps installed outside the Play Store, and of shared storage |
| iOS and iPadOS | A strict application sandbox and App Store review | No file scanning is possible, as no app may read another's files. Web filtering or breach alerts instead |
The full entry explains each row and what it means for a multi-device licence.
The product this site links to
Surfshark Antivirus is made by Surfshark and is the subject of the one product entry here. The referral programme this publisher takes part in states that it is offered for mobile devices running Android, iOS and Windows, desktops running macOS, Windows and Linux, and tablets running iOS, Android and Windows, and that it is sold as a purchase.
That is the extent of what can be stated with a source. Pricing in Australian dollars, subscription length, renewal behaviour, feature detail and detection performance are not published here, because this site has no measurement of them. The vendor's own site states those, and the comparison method lists what to read before paying.
Advertising link. Surfshark pays Momentum Space a percentage of the sale if you subscribe after following it. It opens the vendor's own site in a new tab, where all pricing and terms are set by Surfshark, not by us.
The catalogue entry covers the same ground at length, with a list of what a reader should check themselves.
Independent Australian sources
Nothing here substitutes for the material published by bodies answerable to the Australian public. Each is free and covers ground this site deliberately does not.
- Australian Cyber Security Centre — the Australian Signals Directorate's cyber security arm, publishing device guidance for individuals and small business, and operating the ReportCyber service.
- Scamwatch — run by the National Anti-Scam Centre at the ACCC, describing current scam methods including the fake support calls and pop-ups that impersonate security software.
- eSafety Commissioner — the online safety regulator, with guidance on shared and family devices and on monitoring apps installed by someone known to the owner.
- Office of the Australian Information Commissioner — the privacy regulator, publishing the Australian Privacy Principles and handling privacy complaints.
- Australian Competition and Consumer Commission — administers the Australian Consumer Law, including the consumer guarantees that apply to software bought by Australian consumers.
How coverage here is decided
The concept entries are written from checkable material: vendor and operating system documentation, and publications from the bodies listed above. The product entry covers one product, and it is the one this publisher earns a commission on. No other vendor is ranked against it, because a comparison built on untested products would be fiction.
Commission does not change the wording of an entry, and no vendor reviews these pages before publication. What it changes is scope, and pretending otherwise would be the dishonest part. About Momentum Space states the method in full.
What this site does not do
It collects nothing: no form, no newsletter, no account, no chat widget, and no field into which anything can be typed. It sets no cookies and runs no analytics or advertising script, so no consent banner appears — there is nothing to consent to. The cookie policy and privacy policy describe exactly that.
It also scans nothing. No page here inspects a device or reports on its condition, because a web page cannot, and one that appears to is usually a technique described on Scamwatch. Nor is this advice for a particular situation: for a business network or a suspected compromise, the ACSC's guidance and a qualified practitioner are the route, as the terms say.