It has 2 kinds, IP and file protection. The IP blocks malicious links, and the file protection isn't exactly a realtime, from what I understood. It only detects a malicious file on your PC when you click on it, it's not necessary that it has to be a double click, just click on it. Then you'll get a pop-up with quarantine and ignore. When a popup appears, your PC will stop responding to you. You have to choose one option and then you can use the PC. Thats what I understood
