Patent ID: 7676845

Claim:
In a computing device that includes a processor and system memory, the computing device also including an operating system for managing data object storage for the computing device, a method for determining if data objects that are to be accessed by the computing device contain malware, the method comprising: access an indication that a plurality of objects are to be accessed at the computing device; selectively scanning one or more of the plurality of objects for malware, selective scanning including scanning at least one of the plurality of objects and bypassing the scanning of at least one of the plurality of objects, including for each of the plurality of objects: if the object was not received from a trusted source, scanning the object for malware; and if the object was received from a trusted source: the processor referring to an integrity table, the integrity table including an entry for each object received from a trusted source, each entry including: a file ID, a validated value, and a time stamp, the file ID uniquely identifying the object, the validated value indicating whether or not the object was validated, and the time stamp indicating the last time an attempt was made to validate the object; and if the validated value indicates that the object has not been validated, scanning the object for malware; and if the validated value indicates that the object has been validated, referring to the time stamp to determine if the object has been modified since the last attempt to validate the object; if the object has not been modified since the last attempt to validate the object, bypassing the scanning of the object to conserve computing device resources; and if the object has been modified since the last attempt to validate the object, performing an integrity check on the object to attempt to validate the object.