Remote computing system providing malicious file detection and mitigation features for virtual machines

A method for using a computing device comprising:

• operating a plurality of virtual computing sessions on the computing device for a plurality of client devices;
• operating a virtual security appliance on the computing device to detect security threats from the virtual computing sessions;
• operating a hypervisor to run a virtual machine based upon a virtual disk, with a given one of the virtual computing sessions running on the virtual machine;
• operating a respective internet browser agent on each of the virtual computing sessions;
• operating a virtual management agent on the computing device to, responsive to detection of a security threat from a the given virtual computing session, and without shutting down the given virtual computing session, block access to a URL path active at the internet browser agent on the given virtual computing session at a time of detection of the security threat to quarantine the given virtual computing session from the URL path;
• and
• operating the virtual management agent to, responsive to detection of the security threat from the given virtual computing session by the virtual security appliance, restore the virtual disk to a version thereof created prior to a time of detection of the security threat.

A non-transitory computer-readable medium having computer-executable instructions for causing a computing device to perform execute a process including steps comprising:

• operating a plurality of virtual computing sessions for a plurality of client devices;
• operating a virtual security appliance to detect security threats from the virtual computing sessions;
• operating a hypervisor to run a virtual machine based upon a virtual disk, with a given one of the virtual computing sessions running on the virtual machine;
• operating a respective internet browser agent on each of the virtual computing sessions;
• operating a virtual management agent to, responsive to detection of a security threat from a the given virtual computing session, and without shutting down the given virtual computing session, block access to a URL path active at the internet browser agent on the given virtual computing session at a time of detection of the security threat to quarantine the given virtual computing session from the URL path;
• and
• operating the virtual management agent to, responsive to detection of the security threat from the given virtual computing session by the virtual security appliance, restore the virtual disk to a version thereof created prior to a time of detection of the security threat.