main components are a filter driver (which intercepts certain file operations) and a service which performs the scans. These are naturally "memory resident" - the term itself goes back to the early (DOS) days and isn't really applicable to current OSs. So what's your concern? Any decent AV attempts to become part of the game as soon as feasible but normally doesn't replace the boot-loader or interfere with the early boot process.
