Patent ID: 8505101

Claim:
A computer implemented method of scanning a file for malicious codes, the method comprising: detecting, by a client computer, a file access event accessing a file; sending a scan request to scan the file for malicious codes in the client computer; sending a portion of the file but not an entirety of the file from the client computer to a remotely located computer system over a computer network for scanning for malicious codes; in the remotely located computer system, receiving a file handler for the file from the client computer, converting the file handler to a virtual file handler, and providing the virtual file handler to a scan server; scanning, by the scan server, the portion of the file and not the entirety of the file for malicious codes in the remotely located computer system by referring to the virtual file handler instead of the file handler as if the file is local in the remotely located computer; and in the client computer, receiving from the remotely located computer system a result of scanning the portion of the file and not the entirety of the file for malicious codes; wherein in response to detecting the file access event and before sending the portion of the file to the remotely located computer system, determining if a rule in a plurality of rules governs access to the file; and sending the portion of the file to the remotely located computer system in response to detecting that a rule in the plurality of rules indicates scanning the file for malicious codes upon detection of the file access event to access the file.