1. A computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of: identifying one or more positions in a physical memory associated with a virtual machine; detecting a write operation to at least one of the one or more positions; tracking the write operation in a cluster map that holds information about one or more modified clusters of the physical memory; converting the one or more modified clusters of the physical memory to a set of modified files for a file system of the virtual machine using per-file occupation information provided by the file system; identifying at least one file on the virtual machine from the set of modified files for the file system; receiving an on-access request for the virtual machine; and scanning the virtual machine prior to access to the virtual machine using the physical memory independently of any specific application programming interfaces (APIs) for the virtualization technology, wherein scanning includes performing a scan of the at least one file at the file level with a facility independent of a virtualization capability used to manage the virtual machine, and wherein scanning includes using the set of modified files to limit a scan to a portion of the physical memory containing the at least one file.