1. An apparatus for detecting a malware in files, comprising: an acquisition unit configured to obtain from a file system information about a first time point when a folder is created by the file system, and information about a second time point when a file is created in the folder by the file system; a candidate determination unit configured to determine whether the file created by the file system is a candidate file to be subjected to a malware inspection, based on the information on the first and the second time point; and an inspection unit configured to perform the malware inspection on the file created by the file system when it is determined to be the candidate file for the malware inspection, wherein the candidate determination unit is configured to determine that the file created by the file system is the candidate file to be inspected when the second time point is not within a predetermined time interval from the first time point.