Patent ID: 8161557

Claim:
In a computing device including a processor a method of selectively scanning files for malware in response to a software update, the method comprising: a computing device receiving a software update that contains a malware signature and malware metadata for a malware, the malware metadata defining one or more file types, from among the plurality of different file types, that the malware is capable of infecting, the computing device also including a scan cache of a plurality of scan entries, each scan entry corresponding to a file and including at least a first attribute indicating a file type for the file and at least a second attribute indicating an infection status for the file, the infection status selected from among known safe, known malware, and unknown, each file type selected from among a plurality of different file types; for each scan entry in the plurality of scan entries, the computing device comparing the indicated file type for each corresponding file in the scan entry to the one or more files types defined in the malware metadata; the computing device identifying a plurality of potentially infectable files from the scan cache that have the potential to be infected by the malware by comparing the file type for each of the plurality of potentially infectable files with the one or more file types defined in the malware metadata; the computing device identifying one or more files from the scan cache that are not capable of being infected by the malware by determining that the file type for each of the one or more files is not included in the one or more file types defined in the malware metadata; modifying scan entries in the scan cache that correspond to the plurality of potentially infectable files that were previously identified with a known safe infection status by changing the known safe infection status in the second attribute to an infection status of unknown, such that each one of the scan entries in the scan cache that (1) identifies a file of a type matching the one or more file types identified in the malware metadata and (2) that was previously identified as having a known safe infection status in the second attribute will be modified to have an infection status in the second attribute of unknown; the computing device performing a scan for malware for any of the plurality of potentially infectable files having the second attribute set as unknown in response to receiving an I/O request for the any of the corresponding one or more of the plurality of potentially infectable files; and the computing device retaining scan entries in the scan cache for each of the one or more files identified as not capable of being infected by the malware, without modifying the second attribute; and the computing device refraining from scanning the one or more files that are identified as not capable of being infected by the malware in response to any I/O request for said any of the one or more files identified as not capable of being infected by the malware.