1. A method for detecting malicious code within a first virtual machine comprising: creating a snapshot of the first virtual machine; creating a second virtual machine; making the second virtual machine to be a replica of the first virtual machine, including transferring the snapshot of the first virtual machine to the second virtual machine as a disk image; running a scan operation on the snapshot of the first virtual machine at the second virtual machine using resources of the second virtual machine; and in response to detecting malicious code during the scan operation using the resources of the second virtual machine, taking action at the first virtual machine to address the detection of the malicious code.