A client system comprising at least one hardware processor and a memory, the at least one hardware processor configured to execute an anti-malware engine having a set of configurable scan parameters and configured to monitor a target process for malicious activity, wherein the target process executes on the client system, wherein the target process comprises an instance of a main executable module and an instance of a shared library, and wherein the client system is characterized by having the at least one hardware processor further configured to: receive from a server a first module reputation indicator of the main executable module and a second module reputation indicator of the shared library, the first module reputation indicator determined according to a behavior of another instance of the main executable module, wherein the server is configured to perform anti-malware transactions with a plurality of client systems including the client system, wherein the first module reputation indicator comprises a first set of scan parameter values for configuring the anti-malware engine, and wherein the second module reputation indicator comprises a second set of scan parameter values for configuring the anti-malware engine; in response to receiving the first and second module reputation indicators, determine whether the target process is likely to be malicious according to the first and second module reputation indicators; in response to determining whether the target process is likely to be malicious, when the target process is not likely to be malicious, determine a combined set of scan parameter values according to a set operation applied to the first and second sets of scan parameter values; and in response to determining the combined set of scan parameter values, configure the anti-malware engine to monitor the target process according to the combined set of scan parameter values. receive from a server a first module reputation indicator of the main executable module and a second module reputation indicator of the shared library, the first module reputation indicator determined according to a behavior of another instance of the main executable module, wherein the server is configured to perform anti-malware transactions with a plurality of client systems including the client system, wherein the first module reputation indicator comprises a first set of scan parameter values for configuring the anti-malware engine, and wherein the second module reputation indicator comprises a second set of scan parameter values for configuring the anti-malware engine; in response to receiving the first and second module reputation indicators, determine whether the target process is likely to be malicious according to the first and second module reputation indicators; in response to determining whether the target process is likely to be malicious, when the target process is not likely to be malicious, determine a combined set of scan parameter values according to a set operation applied to the first and second sets of scan parameter values; and in response to determining the combined set of scan parameter values, configure the anti-malware engine to monitor the target process according to the combined set of scan parameter values.