Patent ID: 7752667

Claim:
A method, comprising: creating a file signature for each write process associated with a computer file prior to a virus scan operation, wherein said file signature includes a write time stamp corresponding to the time and date the write process was performed, a hash value corresponding to said computer file as well as a hash value time stamp corresponding to the time and date that the hash value was created; during said virus scan operation, comparing the hash value time stamp with the write time stamp; comparing the previously-created file signature with a virus signature during said virus scan operation in response to the write time stamp matching the hash value time stamp within a predetermined criterion; creating a new hash value and updating said previously-created file signature to include the new hash value during said virus scan operation only in response to said write time stamp not matching said hash value time stamp within the predetermined criterion, and retaining the hash value in the previously-created file signature only in response to the write time stamp matching the hash value time stamp within the predetermined criterion; comparing the updated file signature with the virus signature during said virus scan operation in response to the write time stamp not matching the hash value time stamp within the predetermined criterion; and determining if a virus exists in said computer file, based on the comparison of the updated file signature with the virus signature.