Before a mod enters Mortar's store, Mortar scans it with Windows Security or, on Linux, ClamAV's clamd when running. A flagged file refuses the install and deletes the extracted files. The error (Flagged by <scanner>: <name> in <file>) offers Install anyway, which asks to confirm, installs that mod once without a scan and records it in the profile's history. A scan that cannot finish installs the mod and warns you.

Settings › General › Antivirus picks Automatic, clamd socket (with its path), Custom command (a program given the folder as {path}: exit 0 is clean, any other code is a detection named by the first line it prints) or Off. Scanner in use names what Mortar found, or "No antivirus found".