1. A computer-readable medium having computer-executable instructions, which when executed perform actions, comprising: starting a scan of files included on a storage device; creating a data structure that indicates at least one directory included on the storage device; sending the data structure to a first server and an indication of a last successful communication with the first server; receiving information for files that have been added to the at least one directory after the last successful communication with the first server; and using the information to determine whether one or more of the files are designated as good or malware.