Systems and methods for detecting malware

A system for detecting malware, the system comprising:

• an identification module programmed to:
• identify a file represented within a file system by a file name;
• identify a creation of a hard link to the file, the hard link representing the file within the file system by an additional file name;
• an update module programmed to update a database with an association between the file name and the additional file name in response to the creation of the hard link to the file;
• a determination module programmed to identify a file-closing operation within the file system and then determine that a target file name used in the file-closing operation was removed from the file system after the file-closing operation;
• a querying module programmed to query the database using the target file name in response to determining that the target file name was removed after the file-closing operation and, in response to the querying and based on the association, identify an existing file name representing the file, the target file name matching one of the file name and the additional file name and the existing file name comprising one of the file name and the additional file name that does not match the target file name;
• a scanning module programmed to scan the existing file name for malware in response to the file-closing operation instead of scanning the target file name because the target file name was removed from the file system;
• at least one hardware processor configured to execute the identification module, the update module, the determination module, the querying module, and the scanning module.

A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify a file represented within a file system by a file name;
• identify a creation of a hard link to the file, the hard link representing the file within the file system by an additional file name;
• update a database with an association between the file name and the additional file name in response to the creation of the hard link to the file;
• identify a file-closing operation within the file system and then determine that a target file name used in the file-closing operation was removed from the file system after the file-closing operation;
• query the database using the target file name in response to determining that the target file name was removed after the file-closing operation and, in response to the querying and based on the association, identify an existing file name representing the file, the target file name matching one of the file name and the additional file name and the existing file name comprising one of the file name and the additional file name that does not match the target file name;
• scan the existing file name for malware in response to the file-closing operation instead of scanning the target file name because the target file name was removed from the file system.