Hi wjwebbiii,

 

Welcome to the Webroot Community.

 

The default setting for scans with Webroot is the "Deep" setting.

 

A deep scan specifically targets only things that are running, and that definitely or probably will run.  The remainder of the system is considered inert, since the contents are not active or poised to be active.  This remainder is evaluated if and when it becomes active or primes to become active, via on-access scans, process interdiction, etc.  This portion of the protection is handled by realtime shields.

 

If a threat was "missed" because it was not part of the targeted area, it isn't going to run anyway, and it does nothing when just sitting as bits on media.  In the event the threat is read or attempts to execute machine code, it's scanned at that time and caught at that time.

 

Conversely, a "Full" scan will scan everything. You can find more information in this KB Article.

 

For an absolutely entertaining explanation of this process, please see this previous thread.

 

Hope this info helps,

 

BD

---