1. A method for scanning a virtual machine image associated with a most recent non-infected checkpoint of a virtual machine, the method comprising: scanning a set of checkpoints of the virtual machine to identify the most recent non-infected checkpoint, the scanning of the set beginning with a most recently captured checkpoint and then repeatedly progressing to a next most recently captured checkpoint until the most recent non-infected checkpoint is identified; rendering the virtual machine image associated with the most recent non-infected checkpoint to file-system data by translating the virtual machine image into a format understandable to a file system, the translating comprising translating a .cfg or .vmc metadata file into a format understandable to the file system and relating metadata information in the metadata file to contents of the virtual machine image, the metadata information identifying the contents of the virtual machine image as system volumes or data volumes; and scanning the file-system data with an anti-malware engine based on the metadata information.