System, computer program product and method of selecting sectors of a hard disk on which to perform a virus scan

1. A method of performing virus scans comprising:

determining, using a virus definition file, newly-known viruses from previously-known viruses, the virus definition file having a list of viruses correlated each to an existence date, a newly-known virus being a virus for which a scan was not performed during a previous virus scan of a disk and a previously-known virus being a virus for which a scan was performed during the previous virus scan of the disk, an existence date being a date on which a correlated virus is known to become in existence;

determining sectors of the disk in which data has been placed since an existence date of a correlated newly-known virus; and

scanning the data in the determined sectors for the newly-known virus.

2. The method of claim 1 wherein scanning the data in the determined sectors for the newly-known virus includes scanning all data in all sectors of the disk for the newly-known virus.

3. The method of claim 2 wherein each sector into which new or modified data has been placed since scanning the data in the sectors is recorded in a file in a sequence in which the new or modified data is placed on the disk.

4. The method of claim 3 wherein the last recorded sector is tagged for identification after each virus scan.

5. The method of claim 4 wherein each sector into which new or modified data has been placed along with a date on which the new or modified data has been placed in the sector is recorded in the file.

6. The method of claim 5 wherein the disk is analyzed for interesting files in order to determine sectors in which the interesting files are stored on the disk and to virus scan the determined sectors, the interesting files including executable files and macro files.

7. A computer program product on a computer readable storage medium for performing virus scans comprising:

code means for determining, using a virus definition file, newly-known viruses from previously-known viruses, the virus definition file having a list of viruses correlated each to an existence date, a newly-known virus being a virus for which a scan was not performed during a previous virus scan of a disk and a previously-known virus being a virus for which a scan was performed during the previous virus scan of the disk, an existence date being a date on which a correlated virus is known to become in existence;

code means for determining sectors of the disk in which data has been placed since an existence date of a correlated newly-known virus; and

code means for scanning the data in the determined sectors for the newly-known virus.

8. The computer program product of claim 7 wherein scanning the data in the determined sectors for the newly-known virus includes code means for:

scanning all data in all sectors of the disk for the newly-known virus.

9. The computer program product of claim 8 wherein each sector into which new or modified data has been placed since scanning the data in the sectors is recorded in a file in a sequence in which the new or modified data is placed on the disk.

10. The computer program product of claim 9 wherein the last recorded sector is tagged for identification after each virus scan.

11. The computer program product of claim 10 wherein each sector into which new or modified data has been placed along with a date on which the new or modified data has been placed in the sector is recorded in the file.

12. The computer program product of claim 11 wherein the disk is analyzed for interesting files in order to determine sectors in which the interesting files are stored on the disk and to virus scan the determined sectors, the interesting files including executable files and macro files.

13. A system for performing virus scans comprising:

at least one storage device for storing code data; and

at least one processor for processing the code data to determine, using a virus definition file, newly-known viruses from previously-known viruses, the virus definition file having a list of viruses correlated each to an existence date, a newly-known virus being a virus for which a scan was not performed during a previous virus scan of a disk and a previously-known virus being a virus for which a scan was performed during the previous virus scan of the disk, an existence date being a date on which a correlated virus is known to become in existence, to determine sectors of the disk in which data has been placed since an existence date of a correlated newly-known virus, and to scan the data in the determined sectors for the newly-known virus.

14. The system of claim 13 wherein the code data is further processed to scan all data in all sectors of the disk for the newly-known virus.

15. The system of claim 14 wherein each sector into which new or modified data has been placed since scanning the data in the sectors is recorded in a file in a sequence in which the new or modified data is placed on the disk.

16. The system of claim 15 wherein the last recorded sector is tagged for identification after each virus scan.

17. The system of claim 16 wherein each sector into which new or modified data has been placed along with a date on which the new or modified data has been placed in the sector is recorded in the file.

18. The system of claim 17 wherein the disk is analyzed for interesting files in order to determine sectors in which the interesting files are stored on the disk and to virus scan the determined sectors, the interesting files including executable files and macro files.