A method for malware detection on virtual machines, the method comprising: forming, on at least one virtual machine configured to perform an antivirus check, a queue of identifiers of objects for malware analysis; selecting one or more objects in the queue for malware analysis, wherein the selecting comprises: dividing a list of objects for malware analysis into a number of blocks corresponding to a number of virtual machines when a number of virtual machines configured to perform the antivirus check is below a predetermined threshold, or randomly selecting objects in the queue for malware analysis when the number of virtual machines configured to perform the antivirus check is above the predetermined threshold; providing identifiers of the selected objects to a security virtual machine for malware analysis; checking, by the security virtual machine, whether each of the selected objects has been previously provided for malware analysis by another virtual machine; when a selected object has not been previously provided by another virtual machine, performing, by the security virtual machine, a malware analysis of the selected object; and providing, from the security virtual machine to the at least one virtual machine, a malware analysis result for the selected object. forming, on at least one virtual machine configured to perform an antivirus check, a queue of identifiers of objects for malware analysis; selecting one or more objects in the queue for malware analysis, wherein the selecting comprises: dividing a list of objects for malware analysis into a number of blocks corresponding to a number of virtual machines when a number of virtual machines configured to perform the antivirus check is below a predetermined threshold, or randomly selecting objects in the queue for malware analysis when the number of virtual machines configured to perform the antivirus check is above the predetermined threshold; providing identifiers of the selected objects to a security virtual machine for malware analysis; checking, by the security virtual machine, whether each of the selected objects has been previously provided for malware analysis by another virtual machine; when a selected object has not been previously provided by another virtual machine, performing, by the security virtual machine, a malware analysis of the selected object; and providing, from the security virtual machine to the at least one virtual machine, a malware analysis result for the selected object. dividing a list of objects for malware analysis into a number of blocks corresponding to a number of virtual machines when a number of virtual machines configured to perform the antivirus check is below a predetermined threshold, or randomly selecting objects in the queue for malware analysis when the number of virtual machines configured to perform the antivirus check is above the predetermined threshold; providing identifiers of the selected objects to a security virtual machine for malware analysis; checking, by the security virtual machine, whether each of the selected objects has been previously provided for malware analysis by another virtual machine; when a selected object has not been previously provided by another virtual machine, performing, by the security virtual machine, a malware analysis of the selected object; and providing, from the security virtual machine to the at least one virtual machine, a malware analysis result for the selected object.