I was wondering... if antiviruses store virus definition files that contain virus signatures then why wouldn't they get detected as malware by themselves or Windows Defender or any other AV out there?

  • 1
    Have you considered that the definition could be stored as a hash or in an encrypted way?
    – LvB
    Oct 6, 2020 at 4:28
  • 2
    That's a little like asking why someone's handwritten signature would not get confused with the real person. It's a signature...
    – schroeder
    Oct 6, 2020 at 7:00

2 Answers 2


That's a good question, and the answer is they do, or at least they did.

It used to be a common problem and was one of the reasons it was recommended not to install multiple virus scanners, because they would trigger on the other vendors signatures.

Currently nearly all signature files are encoded or packaged in some way that alleviates cross scans of signature files. For example the open source virus scanner ClamScan provides signatures as zip files although their extension is not ".zip". Uncompressing one of these signature files shows content like the following:


The scanner is looking for the binary patterns represented by each of these entries, however these entries are ASCII HEX representations of the binary string, not the actual binary string.

In order for the virus scanners to look for a match, the signature and the scanned files must be in a matching format before comparison. This could be ascii hex or a hash, or anything else but doing so to all of the files is a much higher overhead than simply converting the signatures to raw binary for comparison.

Converted to native binary signatures, they are now in a state that could easily trigger another virus scanner but generally this is now done in-memory only, and not written back out to a file.

For another virus scanner to key on the now native binary signature, it would have to be scanning simultaneously and scanning other in-memory processes. While less common now, this does happen!


Well, I would assume that the antivirus is just using a virus signature, and as such couldn't mistake it for a virus. It's like Schroeder said, the antivirus is just using a signature, it's not actually a virus, merely a way to identify the virus and remove it quickly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .