A method of performing an anti-virus scan of a file system using a database of malware signatures, wherein the database also includes pre-filter information for signatures, the method characterised by: a) for a file stored in the file system, obtaining intermediate scanning results prior to a scan of the file being completed; b) storing the intermediate scanning results in a database; c) applying the pre-filter information to the intermediate scanning results to identify malware signatures for which the file is to be scanned; d) scanning the file using the identified malware signatures; e) updating the database of malware signatures with new and updated malware signatures and pre-filter information; f) during a subsequent anti-virus scan of the file system, prior to performing an intermediate scan of a file stored in the file system, determining if intermediate scanning results relating to that file are available in the database; g) where intermediate scanning results are not available in the database, repeating steps a) and b), and where intermediate scanning results are available in the database, not repeating steps a) and b); and h) repeating steps c) and d) using the intermediate scanning results, wherein intermediate scanning results are results selected from scanning for any of a checksum, file header information, number of file sections, hash values for the file, hash values for parts of the file, key data from emulation, cyclic redundancy check values, and byte search results; and wherein the method further comprises: storing in the intermediate scanning results database a date at which a file was last modified; estimating when infection by a recent malware was first possible; and in a subsequent scan of the file system for a signature of the recent malware, omitting from the scan those files that were last modified before infection by the recent malware was first possible. a) for a file stored in the file system, obtaining intermediate scanning results prior to a scan of the file being completed; b) storing the intermediate scanning results in a database; c) applying the pre-filter information to the intermediate scanning results to identify malware signatures for which the file is to be scanned; d) scanning the file using the identified malware signatures; e) updating the database of malware signatures with new and updated malware signatures and pre-filter information; f) during a subsequent anti-virus scan of the file system, prior to performing an intermediate scan of a file stored in the file system, determining if intermediate scanning results relating to that file are available in the database; g) where intermediate scanning results are not available in the database, repeating steps a) and b), and where intermediate scanning results are available in the database, not repeating steps a) and b); and h) repeating steps c) and d) using the intermediate scanning results, wherein intermediate scanning results are results selected from scanning for any of a checksum, file header information, number of file sections, hash values for the file, hash values for parts of the file, key data from emulation, cyclic redundancy check values, and byte search results; and wherein the method further comprises: storing in the intermediate scanning results database a date at which a file was last modified; estimating when infection by a recent malware was first possible; and in a subsequent scan of the file system for a signature of the recent malware, omitting from the scan those files that were last modified before infection by the recent malware was first possible. storing in the intermediate scanning results database a date at which a file was last modified; estimating when infection by a recent malware was first possible; and in a subsequent scan of the file system for a signature of the recent malware, omitting from the scan those files that were last modified before infection by the recent malware was first possible.