How it works
Antivirus combines detection rules, reputation checks and sometimes behavioural monitoring. Real-time protection checks activity as it occurs, while a manual scan examines selected files or areas on demand.
A practical example
A downloaded installer may be quarantined before it runs. Quarantine separates the suspected file; it does not prove that every previous action on the computer has been reversed.
What to check
Check that protection and updates are active, then review the detection name and affected file. Obtain software from its real publisher; do not restore a flagged file simply to complete an installation.
Record the time and detection details before changing anything. If a business computer is managed centrally, ask its administrator before altering protection. Repeated detections after a restart, unexpected accounts or missing files warrant investigation even when a quick scan subsequently appears clean.
Confirm whether a detection names a quarantined item, a blocked attempt or an unresolved active threat. Those states call for different follow-up and should not be treated as interchangeable.
Limits and safe use
A clean scan reduces uncertainty but is not proof that every account is safe. Stolen credentials, fraudulent messages and unsupported software require checks beyond malware detection.