Known files database for malware elimination

A system comprising:

• a processor operable to execute computer program instructions;
• a memory coupled to the processor and operable to store computer program instructions executable by the processor such that the system is configured for:
• scanning a plurality of files to identify at least one file as potential malware;
• generating information identifying the at least one file, wherein the generated information comprises a secure hash of the at least one file that is generated using a cryptographic hash function;
• querying a database to determine whether the at least one scanned file identified as potential malware is already known to be free from potential malware or known to be representative of malware, wherein the secure hash is evaluated in order to determine its status as being legitimate or representative of malware, wherein the database includes at least one entry representing a file known to legitimate and at least one entry representing a file known to be representative of malware, wherein each entry of the database represents either a file known to be legitimate or a file known to be representative of malware, and wherein each entry further includes information indicating whether the representation of the file is legitimate or representative of malware;
• excluding the at least one file from further analysis if the at least one file is known;
• and
• performing further analysis on the at least one file if the at least one file is not known.

A computer program product comprising:

• a non-transitory computer readable storage medium;
• computer program instructions, recorded on the computer readable storage medium, executable by a processor, for performing:
• scanning a plurality of files to identify at least one file as potential malware;
• generating information identifying the at least one file, wherein the generated information comprises a secure hash of the at least one file that is generated using a cryptographic hash function;
• querying a database to determine whether the at least one scanned file identified as potential malware is already known to be free from potential malware or known to be representative of malware, wherein the secure hash is evaluated in order to determine its status as being legitimate or representative of malware, wherein the database includes at least one entry representing a file known to legitimate and at least one entry representing a file known to be representative of malware, wherein each entry of the database represents either a file known to be legitimate or a file known to be representative of malware, and wherein each entry further includes information indicating whether the representation of the file is legitimate or representative of malware;
• excluding the at least one file from further analysis if the at least one file is known;
• and
• performing further analysis on the at least one file if the at least one file is not known.