Malware protection using file input/output virtualization

A method of defending a computing device against malware, said computing device including a processor, a memory and a network interface, the method comprising:

• utilizing a cloud-based malware scanning service for detecting malware;
• receiving an application on said computing device from a source that is external to said computing device;
• determining that said cloud-based malware scanning service is unavailable after said utilizing and performing malware detection analysis on the application using a local scanning process when said cloud-based malware scanning service is unavailable;
• when it is determined that malware is detected in said application, executing the application in a virtualized environment when said cloud-based malware scanning service is unavailable, said virtualized environment using a real CPU of said computing device but not affecting a normal operating environment of said computing device;
• utilizing a first persistent storage area of said computing device for file input/output (I/O) commands in which to write one or more files from the application, wherein the first persistent storage area is inaccessible by normal operating system commands and is used when the cloud-based malware scanning service is unavailable;
• and
• after said cloud-based malware scanning service again becomes available, scanning said one or more files in the first persistent storage area by said cloud-based malware scanning service to determine if any of the one or more files are malware-free and can be moved to a second persistent storage area of said computing device which is accessible by said normal operating system commands.