One name, several components
The word “antivirus” survives from a time when the product was a single scanner. A current consumer subscription from McAfee, Norton, Bitdefender, ESET or TrendLife installs a set of components that share a subscription and a control panel but do different jobs.
| Component | What it does | Runs |
|---|---|---|
| Real-time engine | Inspects files as they are opened, saved or executed, and network connections as they are made | Continuously, as a system service |
| Scheduled and on-demand scans | Reads stored files against detection data and behavioral rules | On a timetable, or when started |
| Detection updates | Fetches new signatures, rules and cloud reputation data | Several times a day, in the background |
| Browser extension | Rates links and blocks known malicious pages inside the browser | Inside each browser it is added to |
| Firewall | Applies rules to inbound and outbound connections; may replace the operating system’s own firewall interface | Continuously |
| VPN, password manager, identity monitoring | Bundled services that use the same subscription but are separate programs or web services | When opened, or as separate background apps |
Only the first item interacts deeply with the operating system, and it is the one the operating system regulates. The rest are ordinary applications or browser add-ons.
On Windows: the built-in scanner steps aside
Windows 10 and Windows 11 include Microsoft Defender Antivirus, managed through the Windows Security app. Microsoft’s documentation states that when another antivirus product is installed, Microsoft Defender Antivirus automatically disables itself, and the Windows Security app indicates that the other product is in charge. When the other product is uninstalled, Microsoft Defender Antivirus turns itself back on, sometimes after a restart.
The hand-over depends on the third-party product registering with Windows Security Center, which is how Windows knows a replacement is present. Two effects follow from this design:
- A partly removed suite can leave a registration behind, so the Windows Security app reports that an antivirus is present while nothing is actually scanning. Makers publish dedicated removal tools for this situation, which is one reason a suite’s own uninstaller is preferred over deleting its folders.
- The Windows Security app itself reflects what is registered. If the app is disabled by policy, Microsoft notes it may show stale or inaccurate information about installed antivirus and firewall products.
Microsoft also documents that turning Real-time protection off by hand in Windows Security is temporary; it turns back on after a short delay. A preinstalled trial suite therefore takes over from Microsoft Defender Antivirus the moment it is registered, and Microsoft Defender Antivirus resumes when the trial suite is removed.
On a Mac: permissions are granted in System Settings
macOS does not hand over protection in the Windows sense, because it has no user-facing scanner to stand down. Instead it gates what a security program is allowed to see. Two grants matter, both made in System Settings under Privacy & Security:
- Full Disk Access. Without it, a security program cannot read protected locations such as Mail, Messages and Safari data. Bitdefender’s documentation notes that until the grant is made, the antivirus shield and system scan do not work and the program displays a recommendation to grant it.
- A system extension. Since macOS Big Sur (11.0), Apple replaced kernel extensions with system extensions, and a network or endpoint extension signed by the maker must be allowed before web filtering and on-access scanning are fully active. The program shows an “at risk” state until the extension is allowed.
Apple’s design has a side effect worth knowing. Bitdefender documents that the Allow button for a blocked extension can be disabled when the computer is being accessed remotely, or when a remote-control session was recently open; a restart may be needed before it responds. The operating system is deliberately reluctant to let a remote party approve deep system access, which is consistent with the reader note below.
On phones: the store carries the license
Mobile editions are licensed differently. TrendLife’s documentation states that no activation code is needed for purchases made through the app stores, because the subscription attaches to the account automatically. Norton’s mobile documentation describes three routes: a subscription redeemed by signing in to an existing Norton account, a 25-character product key, or a code issued by a service provider that bundles the product with its own plans.
The components also differ. iOS does not permit third-party apps to scan other apps’ files, so the iPhone editions concentrate on web filtering, Wi-Fi checks, and the scam-text and call-screening features that McAfee and TrendLife market under names such as Scam Detector and ScamCheck. Android editions can scan installed apps and storage.
Why one real-time engine at a time
Two real-time engines inspecting the same file operations compete for the same hooks, each seeing the other’s quarantine and scanning activity as suspicious, and each doubling the input/output cost of every file access. Microsoft describes third-party products disabling Microsoft Defender Antivirus as being “by design to prevent potential software conflicts and performance issues”.
On-demand tools that do not install a real-time hook can coexist with a suite, because they only read files when run. The distinction is between something that watches continuously and something that is opened, used and closed.
What the software never needs
The list of legitimate requirements is short: a current operating system, an account on the maker’s domain, a network connection for updates, and the permission grants described above. Absent from that list are a telephone conversation, a remote-control session, and a payment made outside the account.
The United States Federal Trade Commission puts the general rule plainly: legitimate technology companies will not contact a person by phone, email or text message to say there is a problem with their computer, and real security pop-up warnings will never ask the person to call a phone number. A window that appears during browsing and shows a number is produced by a web page, not by the security program, and closing the browser closes it.