Antivirus software checks files and emails, boot sectors (in order to detect boot viruses), but also the computer's RAM, removable media (USB sticks, CDs, DVDs, etc.), data that pass through any networks (including the internet), etc.

Various methods are possible:

Antiviruses can scan the contents of a hard drive, but also the computer's RAM. For the most modern antiviruses, they act upstream of the machine by scanning file exchanges with the outside, both in downstream (download) and upstream (upload or download). Thus, emails are examined, but also files copied to or from removable media such as CD-ROMs, floppy disks, network connections, USB keys...

Source: Wikipedia