1. An apparatus for detecting a malware in files, comprising: an acquisition unit configured to obtain from a file system information about a first time point when an interested folder is created by the file system, and information about a second time point when an interested file is created in the interested folder by the file system; a candidate determination unit configured to determine whether the interested file is a candidate file to be subjected to a malware inspection, based on the information on the first and the second time point; and an inspection unit configured to perform the malware inspection on the interested file determined to be the candidate file for the malware inspection.