So, a plugin is needed. Or, at least, the user must set the on-access protection to High level (scanning all files: open/create/modify).