"Heuristics, what's that? It sounds like some dreadful disease!"
Well, don't worry, all will be made clear.
Heuristic virus detection is a fancy way of a scanner saying, "I'm guessing that is a virus".
The technicalities are really beyond the scope of this article, so I'll just cover on a simplistic level what happens.
Heuristic scanning engines work on the principle that viruses will usually use certain "tricks" or methods of infecting, and therefore if a program looks like it might be using those tricks, there is a possibility that the program is a virus.
Sound simple? No, not really, it's actually incredibly hard to write a foolproof 100% effective heuristics engine. (Engine, simply put, is just a word we use to describe the bit that drives the virus detector and compares files to the database of known infection agents) The more aggressive heuristic scanner may well detect large numbers of so called "False Positives" i.e. files that are really totally innocent but look like they might alter other files, the less aggressive ones might miss files that really are viruses. In reality heuristics work quite well for some types of viruses, such as Macro Viruses, but not so well for other types. However, they are a reasonable attempt at providing protection against currently unknown viruses. Now you see the reason for my comment at the top! In practice, heuristic scanners offer a little more protection than standard scanning, but they are by no means totally effective.
