If a flash drive that you purchased or if an email attachment had malware, then it would only infect your computer. And if it was malware, I suspect the only purpose of it would be to extract data from your computer.

If there is malware (malicious software) on your computer, then it won’t matter one bit whether you use email, iCloud Drive or any other method to share files. The files you share could be hiding the malware—which then makes it a virus.

The point of malware is to only infect the computer it is on to just be malicious. Malware can be something as simple as packaging an app with additional harmless apps that you didn’t know you were getting.

The point of a virus is to spread the virus from one computer to another by either inserting the virus into a file that the user then unknowingly sends to someone, or by accessing the Internet and passing the virus to other computers, or by using your contact list and sending bogus messages with the virus to people.

Both malware and a virus can extract data from the computer. Both can destroy the files on the computer.

And then there’s spyware. This is actually malware.

The new type of malware is called a PUP, Potentially Unwanted Program. These are apps that you download from the Internet.

And finally, there is ransomware. Again, this is a virus.

So if you suspect that you have a virus or malware, your first action should be to install Sophos Home on the computer and run a complete scan, and that should be done with any flash drive or other external drive installed (including your Time Machine drive) so it can also scan them. If it finds nothing, you're safe. If it finds something, Sophos Home will either automatically remove it, or the file will be quarantined for manual deletion. And then you’re safe. If it does find something, there’s a chance that your data has been collected and you should then change ALL of your passwords. Note: if a file in Time Machine drive is found to have something, that file should not be deleted manually or otherwise modified. That means the only way to be rid of that file is to delete the entire backup that it is found in.
Once Sophos Home is installed, it will protect you from malware, viruses, and PUPs in real time. Anything it finds will get deleted or quarantined and nothing bad can happen to your computer. PUPs might only be flagged and leave it up to you to install or delete. If you install a PUP, you are taking a risk. If it installs malware or a virus, Sophos Home will likely detect it. If Sophos Home doesn’t detect it, the consequences could be really bad.
I have been using Sophos Home for over a decade. It does not slow my computer down. It has only found problems with attachments that have come in an email message, and then maybe once or twice a year. Other antivirus apps that I have used either impose unnecessary restrictions by prompting me to be wary of downloading something or flat out prevent me from downloading something because it “thinks” it could be malware. They have also slowed my computer down. And they pop up constant messages to upgrade—and I consider that to be malware.
Sophos Home just works and only bothers me when it can’t properly deal with what it finds. As to how efficient it is, it is rated at the top with others that are declared to be the best in finding bad stuff. No antivirus or malware app is 100% perfect because new stuff is created by the hour and they have to be discovered before they can be protected against. Some antivirus apps use AI to find new viruses. If you don’t have a supercomputer, that process can slow down your computer.
I have been told by Apple support that Sophos Home and CleanMyMac X are malware. In my mind, it is not true. Apple support will insist that those apps be removed before they will continue with their troubleshooting. I have followed their instructions only to discover that removing them did not change the problem I was having. They will also insist on using Malwarebytes to check for malware and viruses. Fine. Do it just to make them happy; then delete it.
We have noted in the past that you should not use two antivirus apps at the same time as they tend to fight each other. Sophos Home and CleanMyMac X get along fine together. CleanMyMac X only does a scan for malware and viruses on demand. I only use that feature if I feel unsure.
When I checked for reviews on the best antivirus apps for Mac in 2022, Sophos Home wasn’t even listed by many. TechRadar listed Sophos Home as #5 with the only reason to not use was that additional features have to be purchased. The only useful additional feature in Sophos Home that only comes with the purchase is protection against getting your computer hijacked by ransomware. Comparing the annual cost of Sophos Home with others that provide additional features at a cost puts Sophos Home as the least expensive.
Check out the TechRadar reviews: https://www.techradar.com/best/best-mac-antivirus-software

https://home.sophos.com/en-us

John R Carter, Sr.