Patent ID: 8302193

Claim:
A computer-implemented method for scanning files for malware, at least a portion of the method being performed by a computing device comprising at least one processor, the computer-implemented method comprising: performing a first scan of the computing device, the first scan comprising: identifying a set of files to be scanned for malware; for each file in the set of files: calculating a first file identifier that represents a first portion of the file; saving the first file identifier in a manner that allows the first file identifier to be retrieved for use in a second scan of the computing device; identifying a first malware identifier, the first malware identifier being associated with a first malware program; comparing the first file identifier with the first malware identifier; when a result of comparing the first file identifier with the first malware identifier suggests that the file comprises the first malware program, calculating a second file identifier that represents a second portion of the file, saving the second file identifier in a manner that allows the second file identifier to be retrieved for use in the second scan, and comparing the second file identifier with the first malware identifier to make a more definitive determination of whether the file comprises the first malware program, wherein the first and second file identifiers are calculated from different, non-overlapping portions of the file; when a result of comparing the first file identifier with the first malware identifier indicates that the file does not comprise the first malware program, making a determination that the file does not comprise the first malware program instead of calculating the second file identifier.