diff --git a/modules/security/malware-scanner.sh b/modules/security/malware-scanner.sh
index 999efa8..d9832dc 100755
--- a/modules/security/malware-scanner.sh
+++ b/modules/security/malware-scanner.sh
@@ -1437,6 +1437,13 @@ delete_standalone_sessions() {
 
 # Main scan menu
 show_scan_menu() {
+    # Build reference database once for the entire menu session
+    if command -v build_reference_database &>/dev/null; then
+        echo "Building system reference database..."
+        build_reference_database 2>/dev/null || true
+        clear
+    fi
+
     while true; do
         print_banner "Malware Scanner"