Semi-synchronous scanning of modified files in real time

1. A computer-implemented method for performing an anti-virus scan of a file in real-time, the method comprising the steps of:

using a computer to execute method steps comprising:

a thread manager detecting that an activity concerning a file has been initiated by a first thread;

responsive to the detection, the thread manager determining that a scan of the file should be conducted;

the thread manager initiating the scan of the file by dispatching the scan to a second thread;

the thread manager delaying completion of the activity by the first thread only long enough for the scan to be dispatched to the second thread;

the thread manager enabling the first thread to complete the activity that was previously initiated concerning the file synchronously with the scan of the file by the second thread and enabling the first thread to perform other tasks synchronously with the scan of the file by the second thread;

the thread manager blocking access to the file by other threads while the scan occurs;

the thread manager detecting that a thread other than the second thread is attempting to access the file during the scan and after the first thread has completed the activity concerning the file; and

the thread manager placing the thread attempting to access the file on a waiting list for accessing the file until the scanning is completed.

2. The method of claim 1 wherein the step of the thread manager detecting that an activity concerned a file has been initiated further comprises the thread manager determining that the first thread is attempting to close the file.

3. The method of claim 1 wherein the step of the thread manager detecting that an activity concerned a file has been initiated further comprises the thread manager determining that the first thread is attempting to open the file.

4. The method of claim 1 wherein the step of the thread manager detecting that an activity concerned a file has been initiated further comprises the thread manager determining that the first thread is attempting to read the contents of the file.

5. The method of claim 1 wherein the step of the thread manager dispatching the scan to a second thread further comprises the thread manager packaging data about the file and dispatching this data to the second thread.

6. The method of claim 1 further comprising the step of the thread manager creating a synchronization object indicating that the scan is occurring.

7. The method of claim 6 further comprising:

the thread manager placing the synchronization object in a group of synchronization objects, wherein the group of synchronization objects indicates which files are currently being scanned; and

the thread manager removing the synchronization object from the group when the scan of the file is finished.

8. The method of claim 1 wherein the step of the thread manager blocking access to the file while the scan occurs further comprises the thread manager blocking all threads other than the second thread from accessing the file while the scan occurs.

9. The method of claim 1 further comprising the steps of:

the thread manager checking a group of synchronization objects to determine whether the file is currently being scanned;

the thread manager finding that a synchronization object for the file is not in the group; and

the thread manager permitting the file access to proceed.

10. The method of claim 1 further comprising the steps of:

the thread manager checking a group of synchronization objects to determine whether the file is currently being scanned;

the thread manager finding the file in the group of synchronization objects; and

the thread manager blocking the file access from proceeding during the scan.

11. The method of claim 1 further comprising the step of the thread manager sending notification of the scan being completed, thereby notifying the thread attempting the file access that it can proceed in conducting the file access.

12. The method of claim 1 further comprising the steps of:

the thread manager detecting a plurality of attempted accesses of the file by at least one thread; and

the thread manager blocking each of the plurality of file accesses while the file is being scanned by the second thread.

13. The method of claim 12 further comprising the thread manager notifying the at least one thread that the scan is complete, thereby notifying the at least one thread that it can proceed in conducting the file access.

14. The method of claim 1 , wherein the thread manager delaying completion of the activity by the first thread only long enough for the scan to be dispatched to the second thread further comprises the thread manager delaying the activity initiated by the first thread during the time that the scan is being dispatched to the second thread, and the thread manager then permitting the first thread to continue with that activity initiated for the file following the dispatch of the scan to the second thread.

15. A computer system for performing an anti-virus scan of a file in real time, the computer system comprising:

a computer-readable storage medium storing executable software portions, comprising:

a software portion configured detect that an activity concerning a file has been initiated by a first thread;

a software portion configured to determine that a scan of the file should be conducted, responsive to the detection;

a software portion configured to initiate the scan of the file by dispatching the scan to a second thread;

a software portion configured to delay completion of the activity by the first thread only long enough for the scan to be dispatched to the second thread;

a software portion configured to enable the first thread to complete the activity that was previously initiated concerning the file synchronously with the scan of the file by the second thread and enabling the first thread to perform other tasks synchronously with the scan of the file by the second thread;

a software portion configured to block access to the file by other threads while the scan occurs;

a software portion configured to detect that a thread other than the second thread

is attempting to access the file during the scan and after the first thread has completed the activity concerning the file;

a software portion configured to place the thread attempting to access the file on a waiting list for accessing the file until the scanning is completed; and

a processor configured to execute the software portions stored by the computer readable storage medium.

16. The system of claim 15 wherein the software portion configured to block access to the file while the scan occurs further comprises a software portion configured to block all threads other than the second thread from accessing the file while the scan occurs.

17. The system of claim 15 wherein the software portion configured to initiate the scan of the file by a second thread further comprises:

a software portion configured to package data to be dispatched to the second thread; and

a software portion configured to track which files are currently being scanned.

18. The system of claim 15 further comprising:

a software portion configured to detect a plurality of attempted accesses of the file by at least one thread;

a software portion configured to block each of the plurality of file accesses while the file is being scanned by the second thread; and

a software portion configured to release the at least one thread attempting to access the file to perform other tasks during the scanning of the file.

19. The system of claim 15 wherein a software portion configured to block access to the file while the scan occurs further comprises a software portion configured to determine that a thread other than the second thread is attempting to open the file, wherein the thread other than the second thread is prevented from opening the file until the second thread has completed the scan of the file.

20. The system of claim 15 wherein a software portion configured to block access to the file while the scan occurs further comprises a software portion configured to determine that a thread other than the second thread is attempting to open the file, wherein the thread other than the second thread is prevented from reading the contents of the file until the second thread has completed the scan of the file.

21. A computer readable medium storing a computer program product for performing an anti-virus scan of a file in real time, the computer program product comprising:

program code for detecting that an activity concerning a file has been initiated by a first thread;

program code for determining that a scan of the file should be conducted, responsive to the detection;

program code for initiating the scan of the file by dispatching the scan to a second thread;

program code for delaying completion of the activity by the first thread only long enough for the scan to be dispatched to the second thread;

program code for enabling the first thread to complete the activity that was previously initiated concerning the file synchronously with the scan of the file by the second thread and enabling the first thread to perform other tasks synchronously with the scan of the file by the second thread;

program code for blocking access to the file by other threads while the scan occurs;

program code for detecting that a thread other than the second thread is attempting

to access the file during the scan and after the first thread has completed the activity concerning the file; and

program code for placing the thread attempting to access the file on a waiting list for accessing the file until the scanning is completed.

22. The computer program product of claim 21 wherein the program code for blocking access to the file while the scan occurs further comprises program code for blocking all threads other than the second thread from accessing the file while the scan occurs.

23. The computer program product of claim 21 further comprising:

program code for detecting a plurality of attempted accesses of the file by at least one thread;

program code for blocking each of the plurality of file accesses while the file is being scanned by the second thread; and

program code for releasing the at least one thread attempting to access the file to perform other tasks during the scanning of the file.

24. The computer program product of claim 21 wherein program code for detecting that an activity concerning a file has been initiated by a first thread further comprises:

program code for determining that the first thread is closing the file;

program code for blocking the opening the file by threads other than the second thread until the second thread has completed the scan of the file.

25. The computer program product of claim 21 wherein program code for detecting that an activity concerning a file has been initiated by a first thread further comprises:

program code for determining that the first thread is opening the file;

program code for blocking the closing of the file by threads other than the second thread until the second thread has completed the scan of the file.

26. The computer program product of claim 21 wherein program code for detecting that an activity concerning a file has been initiated by a first thread further comprises:

program code for determining that the first thread is opening the file;

program code for blocking the reading of the contents of the file by threads other than the second thread until the second thread has completed the scan of the file.