XProtect is Apple's Mac virus ... One way anti-virus software does this is to scan for known app signatures, sizes, and code. They're then compared against downloaded databases of known malware.