When a file is created on a computer, an archive copy of that file is also created and separately stored. Upon a subsequent access to the active copy of that file, a comparison between the active copy and the full archived copy is made to detect any changes. If there are not any changes, then the active copy of the file is assumed to be clean from malicious alteration and the access request is permitted. If an alteration has been made and is detected, then further countermeasures are triggered, such as full virus scanning of that file or blocking of its use. This archiving and comparison technique may be selectively applied to a subset of file types, such as executable files and dynamic link libraries, which are known to be infrequently modified during normal user operations.