Interesting and easy to read article about how an AV engine works.

Building an Anti-Virus engine
by Markus Schmall
last updated March 4, 2002

--------------------------------------------------------------------------------

The article will describe the basic ideas, concepts, components and approaches involved in developing an anti-virus program from scratch from a developerís/software engineerís point of view. It will focus on the main elements of an anti-virus engine (hereafter referred to as AV engine) and will exclude aspects like graphical user interfaces, real-time monitors, file system drivers and plug-ins for certain application software like Microsoft Exchange or Microsoft Office. Although AV engines running/scanning for single platforms (such as Palm OS or EPOC/Symbian OS) can be designed in the same way, this article will focus on designing multi-platform scanning engines, which are far more complex.

The rest of the article can be found here.