Selective malware scanning of files on virtualized snapshots

Abstract

A VCI snapshot associated with a version of a malware infected VCI is scanned for malware. The malware scanning includes selecting a first file of the VCI snapshot and determining that a file, in a previously scanned VCI snapshot associated with another version of the malware infected VCI, which corresponds to the selected first file has a clean reputation indicator. Further, it is determined that the metadata of the selected first file matches metadata of the corresponding file. Based on these determinations, the malware scanning proceeds to scan the next file for malware without scanning the selected first file for malware.