> The program runs continuously in a loop and checks for new files every second. That's not real-time. Real-time on Linux means using fanotify. > 2. Phishing

> The program runs continuously in a loop and checks for new files every second. That's not real-time. Real-time on Linux means using fanotify. > 2. Phishing > 3. Remote access tools > 6. Password attacks None of those things are part of the threat model that antivirus will defend against.