Originally posted here by ACHT_2003
What is in a virus that defines it to a virus scanner?
eg. Size, Name..........
Like tampabay420 said, there are this signatures which basically work like this:

|------------------------------------------------------------------|
| Executable .... | attached virus .. 01 02 03 04 05 ...|
|------------------------------------------------------------------|

What I am trying to say by this pathetic drawing is that the virus attached to the executable has one CONSTANT string 01 02 ... which can be always found in every infected file... That is the signature.

Of course, there are polymophic viruses, which modify themselves with each generation, so finding a signature for them is (nearly) impossible... To find them AV had developed Code Emulation Systems and heuristical methods... Look on Google, you'll find lots of infos.