A method, system, and computer program product provides on-access anti-virus scanning of data files, which can be performed without introducing significant performance degradation and provides delayed file write operation scanning upon interception of a file write operation. A method of detecting a malware comprises the steps of monitoring file access operations of a process, intercepting a file access operation of the process to a file, waiting a time interval, and scanning the file for a malware.