Abstract: A method to protect a file system form a viral infection may include flagging the program in response to opening a local file on a local file system to perform a read operation and opening a shared file on shared or network file system to perform a write or append operation on the local file. The program may also be flagged in response to the program reading or opening itself and the program attempting to write or append itself or any content to the shared file on the shared or network file system or to write or append itself or any content to the local file on the local file system. The program may also be flagged in response to the program attempting to write or append the local file to the shared or network file system and to preserve a filename of the local file in the shared or network file system. The program may also be flagged in response to the program attempting to write or append a remote file to the local file system.