yes, when it intercepts the threat at disk level (while the web shield intercepts earlier, in memory).