Systems and methods for scanning files for pestware on a protected
computer are described. In one variation, locations of each of a
plurality of files in a file storage device of the protected computer are
identified while substantially circumventing an operating system of the
protected computer. Information from each of the plurality of files is
retrieved and analyzed so as to determine whether any of the plurality of
files are potential pestware files. In variations, the operating system
is circumvented while the information from each of the plurality of files
is retrieved. In other variations, before information is retrieved from
each of the plurality of files, a listing of the plurality of files is
sorted according to the locations of the files on the storage device so
as to reduce, even further, the time required to access the plurality of
files.