It seems to me that a better way to go about this would be to use the MD5 signatures as the keys of your hash instead of the file names. The issue is that if a file is bad (by which I presume you mean contains a virus), then you wold want to know about it regardless of what it was named.

Your search would then go like this:

my %bad_file;
for each bad file:
  $bad_file{ md5 of bad file } = 1;

for each system file:
  my $md5 = md5 of system file
  if ($bad_file{$md5}) {
    report this system file
  }
[download]

There is the possibility of getting some false positives, but that's better than not reporting hits simply because the file names don't agree.