Patent ID: 7350235

Claim:
A method for detecting decryption of encrypted viral code in a subject file, comprising: emulating computer executable code in a subject file; maintaining a list of memory regions that have been read and then modified during the emulation; flagging a memory area that is read during emulation of a first instruction in the computer executable code; detecting a modification to the flagged memory area during emulation of a second instruction in the computer executable code; updating the list of memory regions to include the modified flagged memory by: determining whether the modified flagged memory area overlaps a listed memory region of the listed memory regions; and if the modified flagged memory area overlaps the listed memory region, updating a dimension of the listed memory region to encompass the modified flagged memory area; and if the modified flagged memory area does not overlap the listed memory region, adding the modified flagged memory area as a new memory region to the list of memory regions; determining that one of the listed memory regions is larger than a predetermined size; and triggering a viral detection alarm in response to determining that one of the listed memory regions is larger than the predetermined size, the viral detection alarm indicating detection of viral code.