

When it encounters an unknown app, it runs it in a bubble, preventing the app from making any permanent system changes until its cloud-based intelligence reaches a conclusion about the program. Webroot SecureAnywhere AntiVirus avoids the whole problem by using a completely different technique. In any case, the never-ending proliferation of malware would have required an always-growing database. Malware writers quickly learned to write polymorphic programs that mutate slightly with each new copy, foiling simple signature-based detection.


These signatures were elements of malware files that remained invariant, and hence could be used for identification. The earliest antivirus utilities recognized malware by consulting a database of signatures.
