Patent ID: 8726388

Claim:
A method of scanning for malware during execution of one or more applications on a computer system, the computer system comprising: a memory storing computer readable instructions; and a processor configured to read and execute computer readable instructions stored in said memory, wherein said computer readable instructions comprise instructions causing said processor to perform the method comprising: maintaining a directory access table for tracking one or more common directories being accessed by one or more applications, wherein the directory access table includes a directory entry for each common directory being accessed, the directory entry for each common directory comprising a hit count indicating the number of file accesses to the common directory, an entry state indicating whether the associated common directory is in one of a pre-scanning state, a scanning state and a processed state; and an accessed file list indicating the files that have been accessed by one or more of the applications; detecting accesses by the one or more applications to files within a common directory having a directory entry in the directory access table; when the entry state of the common directory is in the pre-scanning state, then performing the step of adding the accessed file(s) to the accessed file list of the directory entry of the common directory based on the detected accesses; updating the hit count and entry state of the directory entry of the common directory being accessed based on the detected accesses, wherein the entry state of the common directory being accessed is changed from a pre-scanning state to a scanning state when the hit count reaches a threshold value; when the entry state of the common directory is in the scanning state, then the method further comprises the steps of: using the detected accesses to the common directory to identify one or more groups of files within the common directory that the one or more applications may subsequently want to access based on the accessed file list, wherein each group of files includes a plurality of files; and triggering parallel or batch scanning of the files in the one or more groups of files for malware prior to the application attempting to access the files in the group or groups; and updating the entry state of the common directory being accessed from a scanning state to a processed state when all of the identified one or more groups of files in the common directory being accessed have been scanned for malware; wherein, when the entry state of the common directory is in the pre-scanning state or the processed state, then performing normal malware scanning of the accessed file(s).