Can file snapshots aid in detecting malware?
This is not likely to be very effective in practice.  Malware might corrupt the file before you were first able to take a snapshot... or, more realistically, it might corrupt the snapshot you have taken, so that the snapshot matches the current version of the file.  It is difficult to defend against that attack.

So, while your idea is not a bad one, it has significant limitations that might render it not terribly useful in practice.

This also assumes that the underlying file is one that should never change.  Of course, in practice, for any given file, there are valid circumstances when the file should be allowed to change.  So this means you'd need some way to recognize valid, legitimate changes to the file.  This starts to get a bit more complex to implement.

You might take a look at Tripwire, which is a system that does something like this -- except it keeps only a cryptographic hash of each monitored file, rather than a full copy of the file.