The present invention provides a method, system, and computer program product for checking for viruses by adding a virus scanning capability to a data transfer device. In a method of the present invention a real-time virus checker is stored on a controller. The virus checker scans data as it is being written to a file. If a virus is detected, the suspected file is flagged. Anti-virus software is then invoked to perform a scan of the entire suspected file. In this manner, demands on CPU resources to perform scans will be greatly reduced as only those files marked as possibly containing a viruse need to be scanned, rather than scanning all the files on the entire data transfer device.