1. A method of scanning computer data for malicious codes, the method comprising: calculating first hash values of a plurality of files stored in a storage device of a client computer, each of the first hash values being a hash value of less than an entirety of a corresponding file in the plurality of files; forwarding the first hash values to a remotely located server computer over a computer network coupling the client computer and the server computer; comparing the first hash values of the plurality of files to first hash values of a plurality of malicious code patterns, a malicious code pattern in the plurality of malicious code patterns comprising a first hash value and a second hash value; detecting that the first hash value of the malicious code pattern matches a first hash value of a suspect file in the plurality of files, the first hash value of the suspect file being calculated from less than an entirety of the suspect file; in response to detecting that the first hash value of the malicious code pattern matches the first hash value of the suspect file, forwarding the second hash value of the malicious code pattern from the server computer to the client computer; forwarding a size of the second hash value of the malicious code pattern from the server computer to the client computer; calculating a second hash value of the suspect file in the client computer; and in the client computer, determining whether the suspect file is infected with malicious code by comparing the second hash value of the suspect file with the second hash value of the malicious code pattern received from the server computer.