Patent ID: 7757290
Filing Date: 2010-07-13
Classification: G06F

Abstract:
1. A computer implemented method of determining whether a host computer that includes a system memory for storing data that is accessible to a central processing unit is infected with malware that is being hidden by a rootkit, the method comprising: (a) causing a device that is communicatively connected to the host computer through an external port to issue a Direct Memory Access (DMA) request for data loaded in the system memory of the host computer to bypass a rootkit on the host computer, wherein the host computer is infected with the rootkit that hooks into the operating system of the host computer to intercept function calls made to an application program interface of the operating system, and wherein by intercepting the function calls, the rootkit prevents application programs running on the host computer from detecting the presence of malware on the host computer; (b) receiving the requested data from the system memory using DMA; and (c) determining on the device whether the data obtained from the system memory of the host computer is characteristic of malware.