RAPID MALWARE SCANNING USING VALIDATED REPUTATION CACHE

1 . A computerized method of restoring a primary computing instance using a validated reputation cache, the method comprising:

creating a first virtual computing instance (VCI) from a first backup of the primary computing instance;

receiving, from a secondary computing device, first file reputation data for a plurality of files of the first VCI;

storing the first file reputation data onto a secondary storage disk drive accessible by the first VCI;

performing a first malware scan of the first VCI using the first file reputation data from the secondary storage disk drive;

upon detection of malware from the first malware scan, creating a second VCI from a second backup of the primary computing instance;

performing a second malware scan of the second VCI using the first file reputation data from the secondary storage disk drive; and

upon detection of no malware on the second VCI, causing the second backup of the primary computing instance to be used as a recovery image to restore the primary computing instance.

2 . The computerized method of claim 1 , further comprising:

creating a first checksum based on contents of the secondary storage disk drive at a first time;

transmitting the first checksum to another computing device;

creating a second checksum based on contents of the secondary storage disk drive at a second time;

transmitting the second checksum to the other computing device; and

receiving a confirmation from the other computing device that the second checksum matches the first checksum,

wherein using the first file reputation data from the secondary storage disk drive is contingent upon the receiving of the confirmation.

3 . The computerized method of claim 1 , further comprising:

creating the secondary storage disk drive as a virtual disk drive;

mounting the secondary storage disk drive to the first VCI; and

mounting the secondary storage disk drive to the second VCI.

4 . The computerized method of claim 1 , wherein one or more of the first malware scan and the second malware scan includes a file-based checksum comparison that comprises:

creating a file checksum of a first file; and

comparing the file checksum with an expected checksum associated with the first file identified by the first file reputation data.

5 . The computerized method of claim 1 , wherein the second backup of the primary computing instance includes one or more files not present in the first backup of the primary computing instance, the method further comprising:

receiving, from the secondary computing device, second file reputation data for the one or more files,

wherein performing the second malware scan of the second VCI further uses both the second file reputation data received from the secondary computing device and the first file reputation data from the secondary storage disk drive.

6 . The computerized method of claim 5 , further comprising storing the second file reputation data on the secondary storage disk drive along with the first file reputation data.

7 . The computerized method of claim 6 , further comprising:

creating a third checksum based on contents of the secondary storage disk drive after storing the second file reputation data on the secondary storage disk drive; and

transmitting the third checksum to another computing device for use validating use of the secondary storage disk drive during a subsequent malware scan of another backup of the primary computing instance.

8 . A computer system comprising:

a memory device;

at least one processor executing one or more virtual machines (VMs); and

a non-transitory computer readable medium having stored thereon program code executable by the at least one processor, the program code causing the at least one processor to:

create a first VM, the first VM includes files restored from a first backup of a primary VM;

receive, from a secondary computing device, first security data for a plurality of files included in the first backup;

store the first security data onto a disk drive accessible by the first VM;

upon detection of malware within the plurality of files from a first malware scan performed using the first security data, create a second VM, the second VM includes files restored from a second backup of the primary VM;

perform a second malware scan of the second VM using the first security data from the disk drive; and

upon detection of no malware on the second VM, identify the second backup of the primary VM to be used as a recovery image to restore the primary VM.

9 . The computing system of claim 8 , the program code further causing the at least one processor to:

create a first checksum based on contents of the disk drive;

transmit the first checksum to another computing device;

create a second checksum based on contents of the disk drive;

transmit the second checksum to the other computing device; and

receive a confirmation from the other computing device that the second checksum matches the first checksum,

wherein using the first security data from the disk drive in the second malware scan is contingent upon the receiving of the confirmation.

10 . The computing system of claim 8 , the program code further causing the at least one processor to:

create the disk drive as a virtual disk drive;

mount the disk drive to the first VM; and

mount the disk drive to the second VM.

11 . The computing system of claim 8 , wherein one or more of the first malware scan and the second malware scan includes a file-based checksum comparison that includes:

creating a file checksum of a first file; and

comparing the file checksum with an expected checksum associated with the first file identified by the first security data.

12 . The computing system of claim 8 , wherein the second backup of the primary VM includes one or more files not present in the first backup of the primary VM, the program code further causing the at least one processor to:

receive, from the secondary computing device, second security data for the one or more files,

wherein performing the second malware scan of the second VM further uses both the second security data received from the secondary computing device and at least some of the first security data from the disk drive.

13 . The computing system of claim 12 , the program code further causing the at least one processor to write the second security data to the disk drive along with the first security data.

14 . The computing system of claim 13 , the program code further causing the at least one processor to:

create a third checksum based on contents of the disk drive after storing the second security data on the disk drive; and

transmit the third checksum to another computing device for use validating use of the disk drive during a subsequent malware scan of another backup of the primary VM.

15 . A non-transitory computer storage medium having stored thereon program code executable by a processor, the program code embodying a program code method comprising:

creating a first virtual computing instance (VCI) from a first backup of a primary computing instance;

receiving, from a secondary computing device, first file reputation data for a plurality of files of the first VCI;

storing the first file reputation data onto a secondary storage disk drive accessible by the first VCI;

upon detection of malware on the first VCI from a first malware scan performed using the first file reputation data, creating a second VCI from a second backup of the primary computing instance;

performing a second malware scan of the second VCI using the first file reputation data from the secondary storage disk drive; and

upon detection of no malware on the second VCI, causing the second backup of the primary computing instance to be used as a recovery image to restore the primary computing instance.

16 . The non-transitory computer storage medium of claim 15 , the program code method further comprising:

creating a first checksum based on contents of the secondary storage disk drive at a first time;

transmitting the first checksum to another computing device;

creating a second checksum based on contents of the secondary storage disk drive at a second time;

transmitting the second checksum to the other computing device; and

receiving a confirmation from the other computing device that the second checksum matches the first checksum,

wherein using the first file reputation data from the secondary storage disk drive is contingent upon the receiving of the confirmation.

17 . The non-transitory computer storage medium of claim 15 , wherein one or more of the first malware scan and the second malware scan includes a file-based checksum comparison that comprises:

creating a file checksum of a first file; and

comparing the file checksum with an expected checksum associated with the first file identified by the first file reputation data.

18 . The non-transitory computer storage medium of claim 15 , wherein the second backup of the primary computing instance includes one or more files not present in the first backup of the primary computing instance, the program code method further comprising:

receiving, from the secondary computing device, second file reputation data for the one or more files,

wherein performing the second malware scan of the second VCI further uses both the second file reputation data received from the secondary computing device and the first file reputation data from the secondary storage disk drive.

19 . The non-transitory computer storage medium of claim 18 , the program code method further comprising storing the second file reputation data on the secondary storage disk drive along with the first file reputation data.

20 . The non-transitory computer storage medium of claim 19 , the program code method further comprising:

creating a third checksum based on contents of the secondary storage disk drive after storing the second file reputation data on the secondary storage disk drive; and

transmitting the third checksum to another computing device for use validating use of the secondary storage disk drive during a subsequent malware scan of another backup of the primary computing instance.