Method and apparatus for increasing the speed of the detecting of computer viruses

A method for increasing the speed at which a computer scans for the presence of a computer virus, said method comprising the steps of:

• gathering initial state information about an initial state of a volume and storing said initial state information in a scan information cache on a non-volatile storage medium;
• storing said initial state information in said scan information cache;
• gathering current state information about a current state of said volume;
• determining how said initial state information stored in said scan information cache for said volume differs from said current state information for said volume thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses which affects state information of said volume in certain characteristic manners;
• scanning said volume for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present.

An apparatus that can rapidly scan for the presence of a computer virus comprising:

• a scan information cache on a non-volatile storage medium;
• means for gathering initial state information about an initial state of a file stored on a computer storage medium and storing said initial state information in said scan information cache;
• means for storing said initial state information in said scan information cache;
• means for gathering current state information about a current state of said file;
• means for determining how said initial state information stored in said scan information cache for said file differs from said current state information for said file thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses which affect state information of said file in certain characteristic manners;
• means for scanning said file for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present, said means for scanning being operated by a computer having access to said computer storage medium.

An apparatus that can rapidly scan for the presence of a computer virus comprising:

• a scan information cache on a non-volatile storage medium;
• means for gathering initial state information about an initial state of a volume stored on a computer storage medium and storing said initial state information in said scan information cache;
• means for storing said initial state information in said scan information cache;
• means for gathering current state information about a current state of said volume;
• means for determining how said initial state information stored in said scan information cache for said volume differs from said current state information for said volume thereby indicating a presence or absence of one or more subsets of computer viruses, said one or more subsets each including one or more viruses each which affect state information of said volume in certain characteristic manners;
• means for scanning said volume for one or more of said subsets of computer viruses of a type of computer viruses that are determined to be present, said means for scanning being operated by a computer having access to said computer storage medium.