1. A method of scanning a computer system for malware, the method comprising: determining when an application being executed on the computer system is attempting to open a file including intercepting messages that request the creation of a new file or opening of an existing file; intercepting a response to any detected file open request messages in order to obtain a handle assigned to the file; using said handle to intercept write operations to said file by said application; copying data written to the open file by the application into a malware scanner queue; and notifying the application that the file has been closed and then scanning the queued file data to determine if the data relates to potential malware.