1. A method for detecting malicious code within a first virtual machine comprising: creating a snapshot of the first virtual machine; transferring the snapshot to a second machine; running a scan operation on the snapshot using resources of the second machine; and in response to detecting malicious code during the scan operation, taking action at the first virtual machine to address the detection of the malicious code.