Patent ID: 8065730

Claim:
A system for scanning files for malware in a file system that supports virtualization, wherein an operating system provides a filter driver that modifies a value of a virtualization bit in the file system that indicates whether a shared file is virtualized, the system comprising: a non-transitory computer-readable storage medium storing executable computer program modules comprising: a scanning module for identifying a shared file to scan for malware; a virtualized file detection module with administrator privileges for determining that the shared file is virtualized as one or more virtualized versions by examining an unmodified virtualization bit of the shared file, wherein examining the unmodified virtualization bit comprises at least one of: reading the unmodified value of the virtualization bit before the virtualization bit is modified by the filter driver; parsing a structure of the file system to read the unmodified value of the virtualization bit; and running a slave process with virtualization enabled to read the unmodified value of the virtualization bit; a file retrieval module for locating the one or more virtualized versions of the shared file; and a malware detection module for determining whether the shared file and the located one or more virtualized versions of the shared file contain malware; and a processor for executing the computer program modules.