On-access malware scans occur when:
Files are created. These include files that are downloaded from an Internet browser, new files created on the host by any process, files extracted from archives, and files created by a copy and paste action.
Files are executed (a process is launched).
Files are opened. These include existing files opened from Windows Explorer, from media such as a USB or CD/DVD drive, and from network folders.
You can also configure malware protection to perform on-access malware scans of network files. These configuration settings allow you to manage how malware detection performs malware scanning for files accessed over your network. Scanning options include performing malware scans on file read-only operations, file write-only operations, or on file read and write operations. See Enabling and Disabling On-Access Network Scans for more information.
Note
On-access malware scans are not supported on Linux hosts.