Patent ID: 8402544

Claim:
A method of incrementally scanning a file for malicious codes, the method to be performed by a client computer and comprising: scanning the file for the malicious codes using a first set of malicious code signatures in a first scanning instance in a client computer; generating a metadata for the file, the metadata for the file identifying the first set of malicious code signatures employed to scan the file in the first scanning instance; receiving a second set of malicious code signatures in the client computer after the first scanning instance; checking the metadata for the file to identify a third set of malicious code signatures, the third set of malicious code signatures comprising malicious code signatures present in the second set of malicious code signatures but not in the first set of malicious code signatures; and rescanning the file for the malicious codes using the third set of malicious code signatures in a second scanning instance, the second scanning instance being after receiving the second set of malicious code signatures in the client computer.