when scanning files does it scan the registry and memory? also does the AV in realtime check registry and memory?
Both the real time and on demand scanner will scan memory. I am not sure about the registry.
so the registry can still be infected by malware if it gets installed?
thats not good.
Defense+ is keeping an eye on the registry.
Take a look at Defense+ → My Protected Registry Keys.
If you feel some important keys aren’t addressed, you could always add them yourself.
what about viruses that create registry keys and if someone allows a virus to be installed for any reason. then the AV cant remove the keys?
I don’t know if it will remove registry keys or not. Maybe one of the forum users who run a VM and like to test malware will have some input.
Very few if any AV’s will do anything with the registry. They will remove or quarantine detected bad files and that should render any registry entries pointing to those files harmless. In the same way that leftover registry entries made by a program you have uninstalled will most likely do no harm other than cluttering the registry and making it take up more resources than it should. A good registry cleaner will remove any entries that point to files or folders that no longer exist.