How does detection work with avira's cloud? I've been playing around with it for a few days now in a VM and have never had a cloud upload/detection of a file on creation or on download. However said file will then be detected with a subsequent right click scan with the (cloud) addition on the end of the name. So, per say in the even of a malware attack would a file be cloud scanned/detected on execution or just with a right click scan? Should be noted I am not running samples in the VM just checking static detection's.