What is the difference between a virus definition, and an antivirus's engine?

Question

Can I use an antivirus and just update definition, without updating its engine? What does the engine do?

Answer 1

"Engines" usually refer to the 'mechanism' or underlying components that do the actual work or task of the application in question. It's the code that makes it 'go' and do whatever it does.

In your specific example, the anti-virus 'program' has the vendors 'engine' for the actual file examination, plus other components that reach out to the 'Net for updates; a user interface; display; and so on.

Version numbers can mean that tweaks to the preceding package (perhaps the engine) have been made to refine sub routines, or have new routines for that engine to perform.



"Definition" update would be adding to the 'library' of known virus signature strings (or fingerprints) which the engine uses to compare on board files to.

Engine versions may not work with fresher definition library updates, so you should always move to the latest engine version and it's corresponding definitions.

Answer 2

2

Answer 3

The virus definitions or commonly called the latest known threats are downloaded into the virus database...so that if a signature is detected of those known threats you will get notified...the Engine on the otherhand is simply the Drivers and Executable part of the Antivirus Application itself....most of the time you will get updates for the virus definitions...and when a new version is released it updates the engine with new Drivers and Executable files..............This all may sound complicated..but it's not once you understand how a AV product works......