System and method of logical prefetching for optimizing file scanning operations

1. A computer-implemented method of protecting a computer system against malware, comprising:

intercepting a request to load an executable file;

determining whether a non-scan-based prefetch file exists for the executable file;

responsive to a positive determination that the non-scan-based prefetch file exists, altering the non-scan-based prefetch file to be temporarily unusable;

determining whether a scan-based prefetch file exists for the executable file, wherein the scan-based prefetch file specifies a sequence of data accesses supporting a malware scan of the executable file;

responsive to a positive determination that the scan-based prefetch file exists, prefetching data for the executable file based on the sequence; and

scanning the executable file for malware.

2. The computer-implemented method of claim 1 , wherein the

scanning uses the prefetched data.

3. The computer-implemented method of claim 1 , further comprising:

responsive to a negative determination that the scan-based prefetch file exists:

tracking a sequence of data accesses during the scanning; and

saving the sequence as the scan-based prefetch file for the executable file.

4. The computer-implemented method of claim 1 , wherein the altering comprises at least one of:

renaming the non-scan-based prefetch file; and

moving the non-scan-based prefetch file to a location outside of a prefetch cache.

5. The computer-implemented method of claim 1 , further comprising:

restoring the altered non-scan-based prefetch file upon completion of the scanning.

6. A system for protecting a computer system against malware, comprising:

a non-transitory program storage device readable by a machine and tangibly embodying instructions executable by the machine, the instructions comprising:

a control interception module capable of intercepting a request to load an executable file;

a prefetch cache query module capable of determining whether a non-scan-based prefetch file exists for the executable file;

a prefetch cache alteration module capable of, responsive to a positive determination that the non-scan-based prefetch file exists, altering the non-scan-based prefetch file to be temporarily unusable;

the prefetch cache query module further capable of determining whether a scan-based prefetch file exists for the executable file, wherein the scan-based prefetch file specifies a sequence of data accesses supporting a malware scan of the executable file;

a prefetcher module capable of, responsive to a positive determination that the scan-based prefetch file exists, prefetching data for the executable file based on the sequence; and

a malware scanning module capable of scanning the executable file for malware.

7. The system of claim 6 , wherein the malware scanning module is capable of scanning the executable file using the prefetched data.

8. The system of claim 6 , the instructions further comprising:

a monitor module capable of tracking a sequence of data accesses during the scanning responsive to a negative determination that the scan-based prefetch file exists; and

a prefetch cache module capable of saving the sequence as the scan-based prefetch file for the executable file.

9. The system of claim 6 , wherein the altering comprises at least one of renaming the non-scan-based prefetch file and moving the non-scan-based prefetch file to a location outside a prefetch cache.

10. The system of claim 6 , further comprising:

the prefetch cache alteration module being further capable of restoring the altered non-scan-based prefetch file upon completion of the scanning.

11. A non-transitory program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for protecting the machine against malware, the instructions comprising instructions to:

intercept a request to load an executable file;

determine whether a non-scan-based prefetch file exists for the executable file;

alter, in response to a positive determination that the non-scan-based prefetch file exists, the non-scan-based prefetch file to be temporarily unusable;

determine whether a scan-based prefetch file exists for the executable file wherein the scan-based prefetch file specifies a sequence of data accesses supporting a malware scan of the executable file;

prefetch, in response to a positive determination that the scan-based prefetch file exists, data for the executable file based on the sequence; and

scan the executable file for malware.

12. The program storage device of claim 11 , wherein the

scan uses the prefetched data.

13. The program storage device of claim 11 , further comprising instructions to:

responsive to a negative determination that the scan-based prefetch file exists:

track a sequence of data accesses during the scanning; and

save the sequence as the scan-based prefetch file for the executable file.

14. The program storage device of claim 11 , further comprising instructions to:

restore the altered non-scan-based prefetch file upon completion of the scanning.

15. A computer system having logical prefetching functionality supported by an operating system of the computer system, comprising:

security software in operative communication with the operating system, the security software executable by the computer system, stored on a non-transitory program storage device readable by the computer system and arranged to:

intercept control from the operating system of an executable file requested for execution;

determine whether a non-scan-based prefetch file exists for the executable file;

responsive to a positive determination that the non-scan-based prefetch file exists, alter the non-scan-based prefetch file to be temporarily unusable by the logical prefetching functionality;

scan the executable file for malware;

use the logical prefetching functionality to build a scan-based prefetch file for the executable file, the scan-based prefetch file specifying a sequence of data accesses supporting the malware scan of the executable file; and

use the logical prefetching functionality to prefetch data according to the sequence in advance of a next malware scan of the executable file.

16. The computer system of claim 15 , the security software further arranged to:

return control of the executable file to the operating system upon completion of the malware scan.

17. The computer system of claim 15 , the security software further arranged to:

restore the altered non-scan-based prefetch file upon completion of the malware scan.