Patent ID: 8484734
Filing Date: 2013-07-09
Classification: G06F

Abstract:
1. A method to be performed by a computer running an operating system, the method comprising: building an antivirus system call table containing a reference to an operating system kernel routine, the antivirus system call table being built separately from an operating system call table originally configured by a vendor of the operating system to also have a reference to the operating system kernel routine to allow application programs to send service requests to the operating system kernel routine; sending a service request to open a file from an antivirus in user mode to the operating system kernel routine in kernel mode, the service request being sent to the operating system kernel routine by way of a call path that does not include the operating system call table; in response to the service request to open the file, initiating invocation of the operating system kernel routine from the antivirus system call table; and scanning the file for computer viruses after the operating system kernel routine services the service request to open the file.