Patent ID: 8171551

Claim:
A computer program product embodied on a non-transitory tangible computer readable medium and configured to: search code operable to search said computer program for external call instructions; compare said external call instructions within said computer program with at least one predetermined external call instruction characteristic determined from a plurality of external calls and corresponding to known malware; and identify said computer program as containing malware if said external call instructions within said computer program match a predetermined external call instruction characteristic corresponding to known malware; delete one or more files associated with known malware, wherein the one or more predetermined external call instruction characteristics comprise predetermined sets characterizing external calls, and wherein at least one of the predetermined sets characterizing external calls includes at least one wildcard external call marker that provides a match to any external call within a particular range within the computer program, wherein said sets characterizing external calls have associated characterizing relative position information specifying relative position requirements for matching external calls within said computer program.