If I have malicious software running, and I can see it in the Task Manager, is an AV program expected to scan the processes running and test if they are a virus/malware?
Or, does AV have to:
Detect the program on starting to see if it is a virus. In other words, a program is dormant, not running, no disk scan has been done by AV. The program starts AV detects it.
Scan it on disk.
(Original question) Can AV scan the currently running processes and detect which is a virus? Is that the same as scanning the memory?
Example, if software on a computer is sending out requests to "bad" sites, and I can see it with something like TCPView, should AV see that without scanning the entire disk to find it?