i'm not sure it works like this, but i'm pretty certain:
Antivirus stores a set of exe files,processes , registry keys etc that contain viruses, and scans for them. The exe, process and registry list are fetched from an update server (whenever the application is updated).
I hope that clears some things.