When a file is accessed, the filter driver passes the file to the on-access scanner. The scanner then informs the filter driver if the file is excluded or not. If the file is not excluded, the scanner scans the file and updates the value for the szLastScanned string in the registry. It also updates the corresponding Last file scanned entry in the On-Access statistics dialog box. If the file is excluded, the registry value and the entry in On-Access statistics are not changed.

The string is written into the registry in the value szLastScanned.

The default location is: