Abstract: The present disclosure includes a detection method for files infected by malware, especially ransomware, and an anti-malware system implemented with the method during file transmission, especially for backup or synchronization. Applying the detection method in the present disclosure before file transmission may prevent infection spreading by replace uninfected files with infected files. In one embodiment, the method includes: creating files as “baits” for being accessed by ransomware; and detecting whether files being to be transmitted due to updates including the “baits”. The present disclosure also includes file recovery method while finding malware infection by the detection method of in the present disclosure.