when the program that use that flle unpack it then it will be scanned by the realtime protection