Patent ID: 7779474

Claim:
A non-transitory computer-readable storage medium encoded with instructions, wherein the instructions when executed on a processor comprise: receiving a plurality of notifications from a plurality of clients in network, wherein each of the plurality of clients detected that an attribute of a file was changed, and wherein each of the plurality of notifications comprises a name of the file, a modifying entity, and the attribute of the file, wherein the modifying entity identifies a program that changed the attribute of the file; saving the plurality of notifications to a computer; determining a count of a number of times that the notifications that the attribute of the file was changed were received; selecting a threshold, wherein the selecting the threshold further comprises selecting the threshold that is higher if the modifying entity is trusted by a system administrator and selecting the threshold that is lower if the modifying entity is not trusted by the system administrator; and deciding whether the file includes a suspected virus if the count exceeds the threshold.