Scans permanent storage for viruses by comparing files to known virus definitions. Must be kept up to date on new virus definitions for it to be effective. Antivirus software uses heuristics - it knows what types of behaviour are likely to be used by a malicious program. Heuristics can be used to guess which programs or files may contain a virus, based on their behaviour. Sometimes a virus check may flag a harmless file as a virus.