Patent ID: 7945787

Claim:
A method for detecting malware using a remote server, comprising: generating a hash value for a file; transmitting the hash value to the remote server; comparing, at the remote server, the hash value to a list of hash values associated with one or more permitted files; based on the comparison, detecting, at the remote server, that the file comprises the malware in response to determining that the hash value for the file has changed; based on a change in the hash value, determining that the file has been changed from a non-executable file to an executable file containing malware, wherein determining that the file has been changed comprises: examining one more properties of one or more permission of the file; and examining a header of the file and determining that the executable file comprises a portable executable file; receiving a notification from the remote server indicating that the file comprises the malware; and preventing at least one operation on the file in response to the determination that the hash value generated for the file for the file has changed.