fig1 is a block diagram illustrating a computer 100 that utilizes scanning software 112 in accordance with the present invention . the computer 100 comprises a central processing unit ( cpu ) 102 , various support circuits 104 , and a memory 106 . the cpu 102 may comprise a microprocessor , instruction set processor , a microcontroller , or similar processing element known in the art . various support circuits 104 may include power supplies , clock circuits , data registers , i / o circuitry , and the like to facilitate operation of the cpu 102 . the memory 106 may comprise random access memory , read - only memory , removable storage , hard disk storage , flash drives , or any combination thereof . the support circuits 104 and the memory 106 are coupled to the cpu 102 . the memory 106 comprises an operating system 108 , one or more applications 110 , one or more files 118 , and the scanning software 112 . the scanning software 112 comprises drivers 114 , a detection area map 120 and , optionally , a file attribute cache 116 with indicia 122 that a file need not be scanned , e . g ., the file was previously scanned clean with definition set x , the file has been digitally signed by a trusted signer , the file has not been modified for longer than z months , and the like . in operation , upon initial activation , the computer 100 boots - up the operating system 108 and any applications and / or files that are necessary for starting the computer . during the initial start - up , a number of load - points may be utilized . for example , items in a start - up folder may be executed at a particular point in the start - up process as well as driver and services loading . at the end of the startup process and / or at particular load - points during the process , in one embodiment , the scanning software 112 is executed to perform a scan of the files and / or applications that have been thus far launched by the computer 100 . in other embodiments , the scan may begin upon user logon , user input ( on - demand scan ), system events , a scheduled event , and the like . upon execution , the scanning software causes the cpu to operate as a scanning module . the scanning software 112 proceeds to scan each application and / or file that is executing to ensure that no malicious or undesirable software and / or files have been launched . generally , the scan matches entries in a database of malicious or undesirable software and files to the software and files that are currently running on the computer . the scanning process may also use heuristics to “ convict ” software based on behavior or other attributes . if any such malicious or undesired software and / or files are identified , the user is generally notified of their existence . once identified , the scanning software 112 can remove or quarantine the malicious or undesirable software and / or files in a conventional manner . in accordance with one embodiment of the invention , the scanning software 112 initially performs an entire scan of the applications and files in a conventional manner and creates a detection area map 120 that identifies the files and / or applications referenced by each detection area ( i . e ., the detection area is evaluated ). information is also gathered on each file , including but not limited to , digital signature information , last modification date , and results of previous file scans . these attributes form indicia 122 that indicates whether a file requires scanning , or not . for each subsequent scan , the scanning software 112 launches and determines whether the detection area has changed since the prior scan . to facilitate change detection , the drivers 114 monitor the load - points to determine if additional files / applications have been loaded at a given load - point , i . e ., the drivers monitor registry calls and file system calls . upon a change being detected by a driver 114 , the driver sets a detection bit that will indicate that the detection area corresponding to the load - point has been changed . thus , upon the next scan , the scan will re - evaluate the detection area . upon a change being detected , the scan software 112 re - evaluates the detection area to produce an updated detection area map . if the detection change bit has not been changed , then the scanning software 112 will not rescan the detection area . as such , the scanning process is accelerated by not having to reevaluate the load - point , i . e ., “ build ” an understanding of the detection area for the load - point at each scan and not scanning when no changes have occurred at the load - point since the last scan . to further accelerate the scanning process , a file attribute cache 116 is optionally used to identify specific files that have been changed within the detection area . the file attribute cache is populated by the drivers 114 monitoring a file system 124 for files 118 that are loaded at a load - point . these specifically identified changed files are rescanned , which are identified by an indicia that a file need not be scanned contained in the file attribute cache 116 . as such , upon a change being identified in the detection area , only the files that are changed ( including new files loaded at the load - point ) are rescanned . such limited file rescanning substantially accelerates the scanning process . fig2 depicts a flow diagram of a method 200 performed when the scanning software initially scans files / applications . the method 200 begins at step 202 and proceeds to step 204 , where the scanning software performs a conventional scan of the files and / or applications . at step 206 , the scanning software monitors the load - points , e . g ., the registry entries or files , for changes that affect automatic loading of application by the operating system . at step 208 , the information gleaned from the initial scan is used to create a detection area map . the detection area map is stored in memory . in addition , at step 210 , the drivers gather information from the file system to identify the files that are called during the load - point and assigned to the registries . the attributes of these files are optionally stored in the file attribute cache along with indicia that a file need not be scanned at step 212 . the initial scan process ends at step 214 . the method 200 is executed upon the initial utilization of each load - point , or whenever a scan is performed . fig3 depicts a flow diagram of a method 300 of performing subsequent ( non - initial ) scanning . the method 300 begins at step 302 and proceeds to step 304 , wherein the scanning software begins the scanning process . at step 306 , the method 300 queries whether the detection area has been changed . the detection area is identified as being changed when a detection area change bit has been altered by the driver ( s ) of the scanning software . the drivers monitor the registries used at each load - point as well as the files and / or applications that are loaded at the load - point . upon comparison of the registries presently used at the load - point with the detection area map , a difference therein indicates a change . such change results in a change bit being set for that detection area . if the detection area change bit is not set ( unchanged from the initial setting ), then the query at step 306 is negatively answered , and the method 300 proceeds to step 308 . at step 308 , the method does not re - evaluate the detection area because it is deemed to be unchanged . the method ends at step 310 . if , on the other hand , the query at step 306 is affirmatively answered and the detection area has been changed since the prior scan , the method 300 proceeds to step 312 wherein the detection area is re - evaluated once again . in essence , the scanning will be performed as discussed with reference to method 200 of fig2 . in short , a conventional scan is performed of the detection area , e . g ., files and applications corresponding thereto to create a new detection area map . once the detection area has been re - evaluated , the method may end at step 310 . in an alternative embodiment , a further acceleration to the scanning process is provided by the use of a file attribute cache at step 324 . once the method 300 deems that the detection area must be scanned again at step 312 , the file attribute cache is accessed to determine if there are certain files that do not have to be scanned . the determination of rescanning is based upon the status of the indicia indicating whether a scan is needed or not . the drivers , if change in a file is detected through monitoring the file system , update the indicia to indicate that a scan is needed . this “ unsetting ” or clearing the indicia informs method 300 that the particular file is to be rescanned . at step 314 , the method 300 queries whether a scan is needed . if a scan is not needed , then the query at step 314 is negatively answered , and the method proceeds to step 316 . at step 316 , the file is skipped because it has been previously scanned . if , on the other hand , the query at step 314 is affirmatively answered , the method 300 will proceed to step 318 where the file needing a scan is rescanned . at step 320 , the method 300 queries whether more files are to be analyzed that are in the file attribute cache . this loop is utilized repeatedly until all the files in the detection area have either been scanned or not scanned as necessary . once complete , the query at step 320 is negatively answered , and the method 300 ends at step 322 . by executing scanning software in this manner , where a scan detection area map is created and that detection area may not be re - evaluated if it has not changed from the prior scan , substantially accelerates the scanning process . thus , reevaluation by the scanning software is avoided for most load - points , i . e ., the files / applications loaded at a load - point do not often change . further acceleration may be provided by the use of a file attribute cache that enables specific files within the detection area to be skipped from scanning depending on stored attributes of the file ( i . e ., previously scanned , digitally signed , last modification date and the like ) have not changed since the prior scan . while the foregoing is directed to embodiments of the present invention , other and further embodiments of the invention may be devised without departing from the basic scope thereof , and the scope thereof is determined by the claims that follow .