Patent ID: 7765558

Claim:
A system for handling an event in a computer system which has a kernel-mode and a user-mode, the system comprising: at least one computing device configured to (a) run a user-mode software application operative to issue a request for a suspension of an occurrence of the event in the kernel-mode, (b) run a first kernel-mode software module operable to use the request in order to activate a second kernel-mode software module operable to effect suspension of a class of events that comprises the event, (c) suspend an occurrence of the event in the kernel-mode of an operating system running on said computing device, (d) cause the event to occur in the user-mode of the operating system, (e) determine if an occurrence of the event in the kernel-mode will compromise the computer system by analyzing the occurrence of the event in the user-mode, and (f) execute at least one security measure if it is determined that the occurrence of the event in the kernel-mode will compromise the computer system; wherein the first kernel-mode software module is further operable to issue an indication that the suspension has been effected, and the user-mode software application is further operable to use the indication in effecting the occurrence of the event in the user-mode.