An idea?
When installing for the first time? On-access may not necessarily pick up things that are lurking…