A plain-language antivirus and security glossary

Twenty-six terms that appear on security product pages, explained without marketing language. Where a term is relevant to a specific product tier, we say so.

Adware

Software that injects advertising into your browsing or desktop. Rarely destructive, often bundled with free downloads, and frequently a sign that something else was installed at the same time.

Antivirus engine

The component that decides whether a file is malicious. Modern engines combine signatures, static analysis, behaviour monitoring and a cloud reputation service.

Behaviour monitoring

Watching a running program for actions typical of malware — encrypting many files quickly, adding itself to startup, disabling recovery — rather than judging the file itself. This is how most ransomware is actually caught.

Botnet

A collection of compromised machines under one operator’s control, rented out for spam, denial-of-service attacks or fraud. An infected home computer can sit in a botnet for years without its owner noticing.

Brute force

Trying passwords until one works. Effective only against short, common or reused passwords; defeated by length, uniqueness and rate limiting.

Credential stuffing

Taking username and password pairs leaked from one service and trying them automatically on hundreds of others. The reason password reuse is the single most costly habit in consumer security.

Dark web monitoring

A service that searches breach dumps and criminal marketplaces for your details and alerts you if they appear. It cannot remove the data. In Norton’s range this is a Norton 360 feature, not an AntiVirus Plus one.

Drive-by download

Malware delivered simply by loading a page, using a flaw in the browser or a plugin. Kept in check mainly by keeping the browser updated.

End-to-end encryption

Encryption where only the two ends can read the content — not the service carrying it. Distinct from transport encryption such as HTTPS, where the service can read what it stores.

Exploit

Code that takes advantage of a specific flaw in software. An exploit for a flaw that has been patched is harmless on an updated machine, which is why updates matter more than almost anything else.

False positive

A clean file wrongly flagged as malicious. Independent laboratories measure this deliberately, because a product that blocks aggressively can look excellent on detection while being unusable in practice.

Firewall

A filter deciding which network connections are allowed. Your router has one; your operating system has one; security suites usually add a more granular one that asks about individual applications.

Heuristics

Rules that judge a file by its structure and characteristics rather than by matching a known fingerprint, allowing brand-new malware to be flagged — at the cost of occasional false positives.

Keylogger

Software that records what you type, including passwords. Usually a component of a larger piece of malware rather than a product in itself.

Malware

The umbrella term for hostile software: viruses, worms, trojans, ransomware, spyware, adware and the rest. “Virus” is a specific and now fairly rare subtype, though the word is still used loosely for everything.

Multi-factor authentication (MFA / 2FA)

Requiring something beyond a password — a code from an app, a hardware key, a fingerprint. The single most effective account protection available to a consumer.

Phishing

Fraud that persuades you to hand over credentials or money, usually by imitating a service you use. Spear phishing is the targeted version, aimed at one person with details that make it plausible.

Potentially unwanted application (PUA)

Software that is not strictly malicious but that most people would not knowingly install — toolbars, “system optimisers”, aggressive bundled extras. Security products usually flag these separately.

Ransomware

Malware that encrypts your files and demands payment for the key. Backups are the only reliable answer; paying funds the next campaign and often produces nothing usable.

Real-time protection

Scanning files as they are written, opened or executed, instead of only during a scheduled scan. The always-on component of any security product.

Sandbox

An isolated environment in which a suspicious program can be run and observed without being able to touch the real system.

Signature

A fingerprint identifying a specific piece of known malware. Fast and precise, but useless against a sample nobody has analysed yet.

Social engineering

Attacking the person rather than the software: urgency, authority, fear, a plausible pretext. No product fully defends against it.

Trojan

Malware disguised as something you wanted — a cracked application, a codec, a game installer. Still the most common way malware is invited in.

VPN

A service that encrypts your traffic to a server it operates, hiding it from the local network and replacing your visible address with its own. It shifts trust to the VPN provider rather than removing the need to trust anyone. Not included in Norton AntiVirus Plus.

Zero-day

A flaw with no available patch, or malware nobody has yet catalogued. Behaviour monitoring and heuristics are what stand between you and these.