The defender’s side
Most accounts of virus history follow the attackers. This one follows the people who tried to detect and remove malicious code, a group that began as a handful of researchers and hobbyists and grew into a large industry. As with the virus itself, there is no single first scanner, and several people worked on the problem independently at around the same time.
Reaper and the idea of a cure
The earliest example of a program written to remove another is Reaper, the program created in the early 1970s to chase and delete the experimental Creeper program as it moved across a research network. It is often called the first antivirus program, although it was really a custom tool for one program in a small community. It still showed an idea that kept returning: if one program can be recognized, another can be written to remove it.
1987: the first tools
For most of the early 1980s there was little to scan for. Viruses were rare, and each was handled by hand. That changed in 1987, when a number of viruses were discovered, among them Jerusalem and a Christmas-greeting program that spread across a corporate network. Several people wrote removal programs that year. In Europe, researchers wrote tools to remove specific infections, and in Germany, a program to disinfect the Vienna virus is often mentioned. Commercial products began to appear in the same period, as small companies, some founded by one or two programmers, sold utilities to find and remove known viruses. Exact dates and names are contested, and company histories sometimes disagree with each other, so it is safest to say that antivirus software appeared in the late 1980s from several places at once.
Signature scanning
The core method was straightforward. Analysts would take a virus, find a short sequence of bytes that appeared in it and nowhere else, and record that sequence as a “signature.” A scanner then searched files and boot sectors on the disk for any signature in its list. If it found a match, it reported the infection and, if it could, repaired the file.
This approach worked well when viruses were few. Its weakness was equally clear: it detects only what it already knows. So users had to obtain updates, first by mail on disks, later by download. The signature list became the real product, and companies employed analysts to update it as soon as new viruses appeared.
Integrity checking
A second idea did not need to know the virus at all. An integrity checker records a fingerprint, usually a checksum, of each program on a clean system. Later, it recomputes the checksums and flags any file that has changed. Since a virus has to modify something to spread, it can be spotted even when it is new. The weakness is that legitimate updates also change files, so users see many false alarms, and some viruses learned to hide their changes.
The arms race
By the early 1990s, virus writers had learned to evade signature scanners. Some programs encrypted most of their code and changed the encryption each time, so no fixed byte sequence remained. These were called polymorphic viruses, and tools for generating them circulated among writers. Others, called stealth viruses, intercepted the operating system’s requests so that an infected file looked clean when scanned.
Scanner makers responded in several ways. They taught their tools to emulate a suspicious program in a protected virtual space and watch what it did once it had decrypted itself. They also added wildcard signatures, memory scanning, and checks for the boot sector at startup.
Heuristics and behavior
Heuristic detection looks for features typical of malicious code rather than one particular virus: instructions that search for other executable files, write to them, or intercept disk operations. It can catch unseen variants of known families, but it also produces false positives, so makers must balance sensitivity against annoyance.
Behavior-based detection, which became common in the 2000s, observes a program while it runs and acts when it does something suspicious, such as modifying many files in a short time. Such tools are especially relevant now that ransomware encrypts documents.
Limits that were proved early
Fred Cohen’s 1980s work argued that a perfect virus detector cannot exist: for any detection method, one can in principle construct a virus that evades it. That conclusion is theoretical, and real scanners are not trying to be perfect, but it explains the permanent feature of the industry. Scanners are always catching up. Good tools reduce risk without removing it.
From scanner to security suite
When broadband arrived, scanning moved from disks to email attachments, downloads and pages opened in web browsers. Products added a personal firewall, spam filtering and automatic updates over the internet. Because the number of new samples became enormous, makers started to use automated analysis and shared databases of file reputation hosted through cloud computing, so that a threat seen on one customer’s machine could protect others within minutes. Modern endpoint products combine many of the methods above, with machine learning models in some cases, although marketing claims around such methods should be read cautiously.
What the story shows
The history of scanning reflects the history of the threat it was chasing. Each time attackers found a way to avoid one method, defenders added another layer. No single technique ever replaced the others, which is why a typical product today still includes signatures, integrity checks and behavior monitoring, descendants of ideas from the 1970s and 1980s.