Antivirus programs work by scanning files and programs for known threats. They use a combination of signature-based detection and heuristic analysis to identify potential threats. Signature-based detection involves comparing files against a database of known malware signatures, while heuristic analysis examines the behavior of files to identify suspicious activities.