For a start VPS updates and streaming updates can also resolve false positives. So that is one instance why it may not be detected on subsequent scans.
You won't get a red popup as that is only for the on-access scanners, so unless that files was running it wouldn't be being scanned.