jpg file to a server located in Belarus every Sunday at 3 AM, that's very odd). and looks for suspicious behavior (e.g.: huh, this one process doesn't seem to do anything but it uploads a. For that you need something that monitors process activity on a machine, and examines how processes are interacting with other processes, memory, files/disks, network interfaces, etc. Unknown threats by and large can't be detected by signature-based antivirus, since they're not in the database. This is either something that is brand new (the latest backdoor trojan that nobody has yet discovered and analyzed), or specifically targeted to a person/group (e.g.: stuxnet, which was designed to specifically target one air-gapped facility in Iran and infected millions of machines before anybody even knew it existed). Things which have not been discovered and cataloged into the database of bad stuff. The other category is, of course, 'unknown' threats. Checking every single file against a database of hundreds of thousands or millions of signatures also is what eats up all your computer's resources. As you said, common sense is sufficient to block nearly all of these threats, and AV doesn't really improve your chances.

This is useful for people who will click on literally everything (like the random pop-up that says 'you have to update Adobe Flash, download this file and open it'). 'Antivirus' as we usually refer to it refers to a signature-based detection engine - it scans every file on your hard disk, and new ones as you download them, and compares them to a signature database of known-bad stuff.

Malwarebytes mac free version