1. A computer storage medium, the computer storage medium not consisting of a propagating signal, the computer storage medium having computer-executable instructions, which when executed perform actions, comprising: starting a scan of files to identify files included on a storage device of a node as good or malware; in conjunction with starting the scan to identify files included on the storage device of the node as good or malware, creating a data structure that indicates directories included on the storage device, the data structure further indicating a hierarchy of the directories, a date and timestamp for a creation of each directory; sending, by the node, the created data structure to a first server and an indication of a last successful communication with the first server; receiving, by the node, information from the first server for files that have been added to the at least one directory after the last successful communication with the first server; using the information to determine whether a file stored on the storage device is designated as good or malware by: computing a hash of the file stored on the storage device; comparing a directory in which the file resides to a directory that the information from the first server indicates includes the file; sending the hash of the file to a proxy and receiving a response from the proxy as to whether the file is designated as good or malware; if the computed hash of the file is equal to a hash included in the information from the first server and the file is found in a directory that the information from the first server indicates includes the file, determining that the file is designated as good, wherein the creating a data structure that indicates at least one directory included on the storage device, the sending the data structure to a first server and an indication of a last successful communication with the first server, and the receiving information for files that have been added to the at least one directory after the last successful communication with the first server are performed by the proxy.