Not really a standard newbie question...
The reported size can be little tricky because the 'Quick' and 'Normal' scans do not check the files in their entirety, they just check parts of them, hence the resulting total size of scanned data can be much lower than the sum of file sizes (especially when you have large data files stored on the disk).
However, this is different in the case of the 'thorough scan'! This is really suspicious! Have you examined the log - have it really scanned all your files (haven't it missed something)? What about the
number of files tested, does it match the actual number of files on your disks?
About the password protected archives - it can be that there really is an embedded (password protected) archive in the module. Could you please send me a couple of such files? So I could check out what's really going on here...
Thanks
Vlk