Patent ID: 8112806

Claim:
A computer implemented method for detecting infection of a computer by malware operating at a Network Interface Card level, the method comprising the steps of: upon operating system start-up, determining an initial quantification of network transmission activity that has occurred at a Network Interface Card level and an initial quantification of network transmission activity that has occurred at an operating system network driver level; calculating whether there is a difference between the initial quantification of network transmission activity that has occurred at the Network Interface Card level and the initial quantification of network transmission activity that has occurred at the operating system network driver level; determining at least one subsequent quantification of network transmission activity that has occurred at a Network Interface Card level since determining a most recent previous quantification of same, and at least one subsequent quantification of network transmission activity that has occurred at an operating system network driver level since determining a most recent previous quantification of same; calculating whether there is a difference between the at least one subsequent quantification of network transmission activity that has occurred at the Network Interface Card level and the at least one subsequent quantification of network transmission activity that has occurred at the operating system network driver level, taking into account any initial difference; and responsive to results of at least one of the calculating steps, determining whether the computer is infected by malware operating at a Network Interface Card level.