Proactive vs manual detection

I was curious why anti-virus programs in general have a much higher detection rate on manual scans vs real time protection. Why would scanning a hard drive for data threats be more effective than checking the data as it downloads? The same definitions are used for both processes.

 

I am sure there are other reasons but one would be that most viruses are packed in either a rar or zip file with the program that the Downloader thinks they are getting, or with an installer which is many times harmless in itself. While a good AV that scans incoming internet traffic will catch most of these, not every AV catches all of them. It is much easier to detect the threat once opened or upon attempted install\execution when it is in the open so to speak.

 

If you are talking about the AV-Comparatives test:
The Retrospective/ProActive tests are On-demand, against malware unknow to the tested antiviruses which were frozen 3 month ago. Don't confuse them with on-execution ("real-time").

 

you can confuse on-demand with on-access, but do not confuse on-access with on-execution...

 

Thanks for the explanation about the terminology