1. In a computing device including a processor and system memory, the computing device also including an I/O system, a security service application, and a generalized security filter, the computing device having a plurality of disparate antivirus software applications resident at the computing device, the plurality of disparate antivirus software applications including at least first antivirus software and second different antivirus software, a computer-implemented method of aggregating the knowledge base of the plurality of disparate antivirus software applications at the computing device to prevent the execution or spread of malware, the method comprising: (a) the generalized security filter intercepting an I/O-request, the I/O request issued from the I/O system on behalf of a user application resident at the computing device and directed to an I/O device, the I/O request intercepted prior to the request being satisfied by the I/O device; (b) the generalized security filter providing file data associated with the I/O request to the security service application; c) the security service application scheduling scans for a selected one or more antivirus software applications selected from among the plurality of disparate antivirus software applications resident at the computing device based on scanning profiles for each of the plurality of disparate antivirus software applications resident at the computing device; (d) the security service application providing the one or more antivirus software applications with access to the file data even when another application has locked the file containing the file data; (e) each of the one or more antivirus software applications to analyzing the file data to determine if the file contains malware; and (f) at least one of the one or more antivirus applications detecting that the file data contains malware; and (g) preventing the I/O request from being satisfied in response to detecting malware.