Automatic file replication and scanning for malware in a sharing environment is based on detection of file system changes. Only one client of the multi-client environment needs to include malware protection software for all clients to benefit. A file replication service for each client monitors a shared directory, and synchronizes files across clients at the file system driver level. When a new file appears in the shared directory of a client system, through this driver, the new file automatically gets replicated. A malware protection component operates by monitoring the directory for new or modified files. File replication causes automatic malware scanning on the client that has protection. When the file has been cleaned and re-written to the directory, the replication service senses that the file has changed and replicates the cleaned file to the other clients. Thus, the replication behavior produces a multiparty file scanning and cleansing protection scheme.