Abstract: Techniques are disclosed for protecting a computer system from computer virus infection by identifying a set of files authorized for storage in the computer system. The authorized set of files may be identified at the time the computer is configured for use. The computer may be scanned periodically for files not in the authorized set. If any unauthorized file is found, an appropriate action is taken in response, such as notifying a system administrator, shutting down the computer, or taking the computer offline. In addition, the computer's process table may be scanned to identify any unauthorized processes. If any such processes are identified, an appropriate action may be taken in response, such as notifying a system administrator, shutting down the computer, or taking the computer offline.