Malware scanning

1. A method of scanning a computer system for malware, the method comprising:

determining when an application being executed on the computer system is attempting to open a file including intercepting messages that request the creation of a new file or opening of an existing file;

intercepting a response to any detected file open request messages in order to obtain a handle assigned to the file;

using said handle to intercept write operations to said file by said application;

copying data written to the open file by the application into a malware scanner queue; and

notifying the application that the file has been closed and then scanning the queued file data to determine if the data relates to potential malware.

2. The method as claimed in claim 1 , wherein the file open request messages are I/O Request Packets, IRP, containing an IRP_MJ_CREATE function code.

3. The method as claimed in claim 1 , wherein the step of copying data written to the open file by the application into a malware scanner queue comprises:

copying the data as the data is written to the open file by the application; and

adding the copied file data into the malware scanner queue.

4. The method as claimed in claim 3 , wherein the step of copying data as the data is written to the open file by the application comprises:

intercepting messages that request data be written to the file, and copying the data identified in the request.

5. The method as claimed in claim 4 , wherein the write data request messages are IRPs containing an IRP_MJ_CREATE function code.

6. The method as claimed in claim 3 , and further comprising:

determining if the application has initiated closure of the file before adding the copied file data the malware scanner queue.

7. The method as claimed in claim 6 , wherein the step of determining if the application has initiated closure comprises:

intercepting messages that request the file be closed.

8. The method as claimed in claim 7 , wherein the file close request messages are IRPs containing an IRP_MJ_CLEANUP or IRP_MJ_CLOSE function code.

9. The method as claimed in claim 1 , wherein the step of adding data written to the open file by the application into a malware scanner queue comprises:

recording a location of the file; and

adding the recorded file location into the malware scanner queue.

10. The method as claimed in claim 9 , wherein the step of recording a location of the file comprises:

intercepting messages that request data be written to the file, and recording the file location identified in the request.

11. The method as claimed in claim 10 , wherein the write data request messages are IRPs containing an IRP_MJ_CREATE function code.

12. The method as claimed in claim 9 , and further comprising:

determining if the application has initiated closure of the file before adding the file location into the malware scanner queue.

13. The method as claimed in claim 12 , wherein the step of determining if the application has initiated closure comprises:

intercepting messages that request the file be closed.

14. The method as claimed in claim 13 , wherein the file close request messages are IRPs containing an IRP_MJ_CLEANUP or IRP_MJ_CLOSE function code.

15. The method as claimed in claim 1 , and further comprising:

recording the time at which the file data was written to the file.

16. The method as claimed in claim 15 , wherein, after the application has initiated closure of the file, the queued file data is only scanned when the age of the file data exceeds a threshold.

17. The method as claimed in claim 1 , wherein, after the application has initiated closure of the file, the queued file data is only scanned when the amount of data in the queue exceeds a threshold.

18. A non-transitory computer storage medium having stored thereon a computer program comprising computer program code means adapted to perform the following steps:

determine when an application being executed on a computer system is attempting to open a file including intercepting messages that request the creation of a new file or opening of an existing file;

intercept a response to any detected file open request messages in order to obtain a handle assigned to the file;

use said handle to intercept write operations to said file by said application;

copy data written to the open file by the application into a malware scanner queue; and

notify the application that the file has been closed and then scanning the queued file data to determine if the data relates to potential malware.

19. A computer system configured to scan files for malware, the computer system comprising:

a malware scanner configured to scan data for malware; and

a processor coupled to memory, the processor configured to determine when an application being executed on the computer system is attempting to open a file including intercepting messages that request the creation of a new file or opening of an existing file, to intercept a response to any detected file open request messages in order to obtain a handle assigned to the file, to use said handle to intercept write operations to said file by said application, to copy data written to the open file by the application into a malware scanner queue, and to notify the application that the file has been closed and then scanning the queued file data to determine if the data relates to potential malware.