1. A method for malware recovery in a computer system comprising: a) repeatedly making associated data backups for each of a plurality of files by making a series of snapshots of file storage volumes containing said plurality of files, each of said data backups comprising versions of said associated file, including uncorrupted versions of said associated file in an uncorrupted state; b) determining that an attack by a malicious program has occurred; c) identifying corrupted files of said plurality of files that were corrupted by said malicious program; d) for each said corrupted file, scanning said series of snapshots to identify an uncorrupted version of said uncorrupted versions of said file; and e) for each said corrupted file, restoring said file to one of said uncorrupted versions thereof.