A computer system uses a virus-scan method capable of full-scanning the logical volume of a SUTOSEN PC with high frequency while limiting the number of virus-scan devices. The computer system includes a primary volume storing data from a personal computer, a snapshot volume storing the status of the primary volume at a given point in time, and a save destination volume storing an updated memory area within the primary volume as information on an updated block address reflected in a bitmap. The updated block address corresponds to a memory area within the primary volume. The computer system detects only an updated file in the primary volume from the snapshot volume and the save destination volume, creates an updated volume for storing a relevant updated file, and thereby executes a virus-scan on the updated volume.