Standard shield driver gets MD5 of files they were opened and NOT infected. If there’s a WRITE request, file MD5 entry is removed from driver’s internal buffer, file is rescanned. If request is READ, there’s no need to rescan the file, because we know it wasn’t modified, etc.

Try this: restart your computer, display Standard Shield info window (where you can see how many files were scanned), execute Help from Start menu, look at how many files were scanned, close Help, run it again (many files were cached and they weren’t rescanned) [note: if you enable all files types scanning in Standard Shield, the difference will be much bigger].

The Servant Salamander files were rescanned, because they were probably modified.