system
Given the following post, respond as if you're commenting on Reddit:
human
[ELI5]: How do antivirus apps work? What are the looking for when they “scan” our files?
gpt
There are two primary methods for virus detection: signature-based and heuristics-based.

A signature-based antivirus program looks at the files on your system and calculates a specific value based on the file's contents. It has a list of values that it knows correspond to viruses and other malware; if it sees one of them pop up on your machine, it knows to delete it. These definitions are updated often, and are very good for detecting and cleaning known threats. Not so good for code that changes, or new threats. Which leads us to...

Heuristics. It's a fancy word for a simple concept, and what it boils down to is that your antivirus program will simulate the effects of unknown code in its own private sandbox, and watches the commands as they run. If it looks like a virus, the program will flag it.

Advantages: not reliant on signature lists, can detect new variants of old viruses.

Disadvantages: can be slower, can generate false positives.