Patent ID: 8856927

Claim:
A method for identifying malicious code running on a computer having a data storage device, the method comprising: starting an operating system on the computer; starting a trusted software component running simultaneously with the operating system; performing an online snapshot process of a current state of the data storage device to store a snapshot of the storage media in a backup storage area, performing the snapshot process including: creating a map of the storage drive absent using drivers of the operating system, the map identifying areas of the data storage device to be copied; upon receipt of a write request to write a block into an area, determining if the area has been previously copied to the backup storage area by the snapshot process; for areas not previously copied by the snapshot process, copying data blocks that need to be re-written from the storage device to intermediate storage and updating a pointer in the map of the snapshot; analyzing data representing the snapshot of the storage media via the trusted software component for snapshot area to detect malicious code; and replacing files with detected malicious code with trusted/malicious code-free copies of the files.