Where the signatures come from
macOS ships Apple’s XProtect rules and keeps them current by itself. DiskDuo reads those same files, so there is no second database to trust and nothing to download.
Where it looks
- Applications and their helpers and login items
- Downloads and the Desktop
- Application Support, for you and for the system
- The shared folder and the temporary folders
- Privileged helper tools
- Every program that starts by itself
Only programs are read — Mach-O binaries, scripts and compiled AppleScript — because that is what the rules describe. iCloud placeholders are skipped so a scan never pulls a file down.
What a result means
A match names the family Apple gave it and the file it was found in. You can reveal it in Finder or move it to the Trash. A clean result means nothing in those places matched the signatures on this Mac today — it is not a guarantee about everything that exists.