Abstract: A unique session key is created for each execution of anti-virus software and is used to create a session stamp for each file scanned during that execution. The session stamp is stored in the directory entry for the file. When a request for the file is made, the anti-virus software uses the current session key to validate the session stamp. An invalid or absent session stamp indicates that the file needs to be scanned.

Abstract: A system and method for the efficient encoding and decoding of protocol messages is described. In one embodiment, an offset from a beginning of a memory buffer is calculated based upon a maximum size of a header portion of the message. A variable length portion of the message is encoded beginning at the offset, and the header portion of the message is encoded based upon an encoded size of the variable portion and a size of the header portion. The encoding of the header portion begins at the offset less the encoded size of the header portion. Further, a set of object identifiers are decoded into a data structure. If a value portion corresponding to an object identifier of the set of object identifiers is variable in length, the value portion is decoded into the data structure.

Abstract: The invention provides for on-access scanning of archives, such as “ZIP” files, for files containing viruses or other unwanted characteristics. In particular, disclosed are various techniques for beginning a scanning operation, and then monitoring the scanning operation to determine whether it is completing in a reasonable time. If the scanning operation is taking place within a terminal server type of environment, such as the Microsoft Terminal Server, where an application program is run in a virtual execution environment, then provision is made to identify client connections to the server so that error messages (such as denying file access due to a virus) can be presented to a terminal server client's terminal, rather than at the terminal server console.