The principal function of an antivirus monitor (which may also be known as a real-time scanner or on-access scanner) is to monitor all attempts to access operations on the protected computer.

Whenever an object on the hard drive is accessed (read, executed, written, etc.), the antivirus monitor will first scan the object. If no viruses are detected, the control is returned to the system and the file operation is allowed. If a virus is detected, the antivirus product performs the actions specified in its settings, e.g., deletes the object, blocks the file operation, etc.

Therefore, when a real-time scanner is running, there is no danger of the system becoming infected, provided that the antivirus product meets all contemporary security requirements.