I got a brand new PC today because I couldn't Bootcamp my Mac due to a shortage of disk space on its SSD. It had McAfee pre-installed on it, and, shortly afterward, I noticed a ton of performance overhead from McAfee, namely its Real-Time Scanning.

I'm a Computer Science major at a community college. From what I understand, programs can only get on a machine by:

  • Downloading them from the Internet
  • Being ran from the OS (they were pre-installed)
  • The user made it and saved it from the machine
  • A CD-ROM or equivalent media
  • A flash drive or other removable storage, which fits into CD-ROM or equiv.

McAfee's Real-Time Scanning scans files on read, from what its description blurb says. Why should it scan on read, and not when the files are written on the hard drive?

One other reason why I as is due to the fact that my aunt has Norton, and I've seen it provide insight on files as they were downloaded.

  • 1
    There are files that are only read (Simplification: you open a PDF, read it, then close it, nothing has been written on the harddrive) and there are files, that are only written (logs for example). So you need to scan both types. EDIT: A read file might be a virus or not, so the antivirus software should make sure that it is not.
    – hamena314
    Commented Feb 17, 2016 at 9:02
  • @hamena314 That PDF got there earlier, so was written.
    – user13695
    Commented Feb 17, 2016 at 10:39
  • @JanDoggen For example, the PDF was written to the disk in 2006 and since then not changed or even opened. In 2016 I find this old file and read it ... it is safe to assume that the file falls into the "read"-category. Another example: A PDF is written to the disk on server A ... then the disk gets plugged into server B. Server B has never written the file, only reads it.
    – hamena314
    Commented Feb 17, 2016 at 10:46

2 Answers 2


Why should it scan on read, and not when the files are written on the hard drive?

Because this will cover the situation when the A/V software is installed after files have been written to the computer.

Also, as new viruses are discovered, they may be an existing threat on the machine that has not yet been detected due to the signature only being available in the latest version of the updates.

  • A similar use case is, when files have been written to a disk on system A, then the HDD gets plugged into system B. System B never wrote the file, only reads it.
    – hamena314
    Commented Feb 17, 2016 at 10:50

How about i make a free tool which will access some server and generate trojan. so it is better to scan it realtime. because there are lots of portable tools. like activation, it will store data in ram than in hdd, run for a short time and makes some changes in the data in the ram and it will be sent to the hdd... or offline package extract in the ram and executes some command in the background...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .