A computer implemented method for detecting malicious files in a distributed network having a plurality of protecting virtual machines, the method comprising: determining and obtaining, by a protected virtual machine, at least one file stored on the protected virtual machine for performing an antivirus scan; collecting, by the protected virtual machine, data relating to characteristics of computing resources of each of the plurality of protecting virtual machines, each having a scanning module, wherein the characteristics of computing resources of each of the protecting virtual machines comprise at least one or more of: - time passed between reception of files and pronouncing a verdict by each scanning module, - a number of files obtained, - CPU load, and - a volume of free memory; determining, by the protected virtual machine, a first approximation time function of the characteristics of the computing resources for each of the plurality of protecting virtual machines based at least on the collected data; collecting, by the protected virtual machine, one or more parameters relating to an antivirus scan of the scanning module of each of the protecting virtual machines, wherein the one or more parameters comprises at least one of: - methods of detection of malicious files used to perform the antivirus scan, and - characteristics of the computing resources used to perform the antivirus scan; determining, by the protected virtual machine, a second approximation function of the one or more parameters relating to the antivirus scan based at least on the collected parameters; determining an approximation time function of effectiveness of the antivirus scan of each protecting virtual machine based at least on the first approximation time function of the characteristics of the computing resources and the second approximation function of the one or more parameters; and based at least on the approximation time function of effectiveness of the antivirus scan, selecting at least one protecting virtual machine from the plurality of protecting virtual machines to perform the antivirus scan in order to determine whether the at least one file is malicious. determining and obtaining, by a protected virtual machine, at least one file stored on the protected virtual machine for performing an antivirus scan; collecting, by the protected virtual machine, data relating to characteristics of computing resources of each of the plurality of protecting virtual machines, each having a scanning module, wherein the characteristics of computing resources of each of the protecting virtual machines comprise at least one or more of: - time passed between reception of files and pronouncing a verdict by each scanning module, - a number of files obtained, - CPU load, and - a volume of free memory; - time passed between reception of files and pronouncing a verdict by each scanning module, - a number of files obtained, - CPU load, and - a volume of free memory; determining, by the protected virtual machine, a first approximation time function of the characteristics of the computing resources for each of the plurality of protecting virtual machines based at least on the collected data; collecting, by the protected virtual machine, one or more parameters relating to an antivirus scan of the scanning module of each of the protecting virtual machines, wherein the one or more parameters comprises at least one of: - methods of detection of malicious files used to perform the antivirus scan, and - characteristics of the computing resources used to perform the antivirus scan; - methods of detection of malicious files used to perform the antivirus scan, and - characteristics of the computing resources used to perform the antivirus scan; determining, by the protected virtual machine, a second approximation function of the one or more parameters relating to the antivirus scan based at least on the collected parameters; determining an approximation time function of effectiveness of the antivirus scan of each protecting virtual machine based at least on the first approximation time function of the characteristics of the computing resources and the second approximation function of the one or more parameters; and based at least on the approximation time function of effectiveness of the antivirus scan, selecting at least one protecting virtual machine from the plurality of protecting virtual machines to perform the antivirus scan in order to determine whether the at least one file is malicious.