But their server-side list of malware is always growing. So it could be valuable to recheck that list. I'm not sure how valuable, but it does have minor upsides

But their server-side list of malware is always growing. So it could be valuable to recheck that list. I'm not sure how valuable, but it does have minor upsides. Of course: 1. If you have run it in the past aren't you already screwed? Maybe this can effectively "disarm" otherwise entrenched malware? 2. Could they track the list of signatures that you have asked about in the past $timeframe and your system can frequently check for newly flagged signatures? This would allow longer caching without high delay until new blocks take effect. (Similar to moving from OCSP to CRLs)