Virus scanners

In this section, we explain the basic operating mode of the virus scanner.

By means of so-called virus signatures or definitions, virus scanners are able to identify malware by comparison with known patterns.

In so doing, a differentiation is made between targeted virus scans ("on demand") and real-time detection during file access ("on access").


Targeted virus scans

Targeted scans are started either by the user himself or automatically by a scheduler. Here, either the entire data media (hard disk, DVD, USB stick) or only certain directories are scanned. As the virus scan can be very resource-intensive, it is recommended that regularly executed scans are scheduled for times where the computer is not otherwise being used. However, should it be necessary to run a scan when the computer is busy, you can, using scan settings in your G DATA product, activate the appropriate options, so that the scan is temporarily paused, if user activity is detected.


Real time detection

In this process, all data accesses are monitored using a so-called background monitor. This means that every file must first pass the monitor before it can be opened. If the monitor detects that the file to be opened is infected, it prevents it from being opened and can also initiate other actions (e.g. immediate deletion, disinfection or quarantining). The background monitor should always be switched on.


HTTP, instant messenger and mail filters

A comprehensive protection concept should detect and remove incoming malware as soon as possible. Common gateways such as web browsers, instant messaging and email programs should therefore be protected using additional filter mechanisms. Background: in spite of background monitors being activated, security loopholes can sometimes allow harmful program code to be running in the memory area of the applications concerned already, without any file access (hard disk) being necessary. G DATA products therefore offer separate filter mechanisms for all internet browsers, instant messenger and email programs and thus provide the highest possible level of protection.



Keeping the virus signatures up to date is of critical importance for the detection performance of the virus scanner. Due to the volume of new malware which arises on a daily basis, the virus signatures should be updated as often as possible. Scheduled automatic updates are helpful in this respect. All G DATA virus protection products offer an hourly update cycle. We strongly recommend that you make use of the hourly update service, as only in such cases is it possible to prevent "aging" of the virus protection and the associated constant decrease in detection performance.