Virtual Kiosk

Few queries…

In VK, I ran a malware from both the desktop & shared folder & AV detected both, that means AV detects for both desktop & shared folder, right?

In VK, I ran an unknown installer from both the desktop & shared folder, when run from shared folder got Unlimited Rights alert but when run from the desktop it run without any Unlimited Rights alert, that means anything running from shared folder is watched by CIS & running from desktop is allowed, right?

In VK, I ran a malware & AV detected & I quarantined it. The malware file was not there on the real desktop too, that means anything detected & cleaned by the AV in VK will also be cleaned from the real system, right?

I have tested only in the Kiosk. I ran a program in the kiosk and installed it then reset the sandbox, went back to the kiosk and it was no longer there. I will try to save something in the shared folder soon to see how that goes.