Editing Malware (section)

====Real-time protection====
A specific component of anti-malware software, commonly referred to as an on-access or real-time scanner, hooks deep into the operating system's core or [[operating system kernel|kernel]] and functions in a manner similar to how certain malware itself would attempt to operate, though with the user's informed permission for protecting the system. Any time the operating system accesses a file, the on-access scanner checks if the file is infected or not. Typically, when an infected file is found, execution is stopped and the file is [[quarantine]]d to prevent further damage with the intention to prevent irreversible system damage. Most AVs allow users to override this behaviour. This can have a considerable performance impact on the operating system, though the degree of impact is dependent on how many pages it creates in [[virtual memory]].<ref>{{Cite journal|last1=Al-Saleh|first1=Mohammed Ibrahim|last2=Espinoza|first2=Antonio M.|last3=Crandall|first3=Jedediah R.|date=2013|title=Antivirus performance characterisation: system-wide view|journal=IET Information Security|language=en|volume=7|issue=2|pages=126–133|doi=10.1049/iet-ifs.2012.0192|issn=1751-8717|doi-access=free}}</ref>