1. A method of protecting a computer workstation from a virus threat, the method comprising: detecting a modification to an executable program file, the file comprising file data and file meta data; creating a hash from the file meta data; adding a flag to the file meta data in response to the modification; storing the hash and the flag in a memory; identifying a virus threat; initiating a lock down mode in response to the identified virus threat, wherein policies are applied to files created or modified after the lock down mode is initiated; identifying the executable program file as being associated with an operation performed after the lock down mode is initiated and applying at least one of a policy for restricted files and a policy for unrestricted files based on at least the file meta data flag associated with the executable program file, the policy applied after detecting the modification to the executable program file.