How do anti-virus programs catch a virus? How they detect it? [closed]

Question

I need to know how anti-virus programs catch malware. Do they do it with hash numbers or not?

Answer 1

The most typical methods to detect a malware are the following:

1. Streams of bytes. As simple as it sounds: find some specific string(s) or stream of bytes.
2. Hashes. Either CRCs or similar to CRC hashes applied to some block of bytes like a section's data inside an executable file (i.e., a PE or ELF file) or the entry point. Each AV engine uses a different "CRC like" set of hashes.
3. Generic detections and heuristics. Code, typically C or C++, that finds evidences and after a number of evidences it's considered "malicious". Some evidences, talking about executable files, can be some specific instructions at the entry point, the number and name of sections in the executable, where the entry point is (i.e., if it's in the last section, etc...), the compilation time-stamp, the imported libraries and functions, the entropy of the file or the entropy of some section inside an executable file, etc...
4. Cryptographic hashes. A long list of MD5 or SHA1 hashes for specific malware samples. A very bad approach, BTW.

Other techniques:

1. Graph hashes. A hash generated out of the call graph of the program or out of the flow graph of some specific function.
2. Behaviour based heuristics. When a program executes a number of specific actions an AV engine can consider that the actions correspond to the actions of some specific malware. The behaviour, depending on the quality of each AV engine, can be get without actually executing the file but emulating it with the AV's emulator (x86, ARM, AMD64, JavaScript, ActionScript, etc...)

Those are the most common techniques used to detect malware by antivirus products.