Patent ID: 8561195

Claim:
A computer implemented method for identifying malware based on its use of a folder shortcut on a computer, the method comprising the steps of: automatically analyzing files on the computer, in order to identify files used to implement folder shortcuts, wherein automatically analyzing files on the computer further comprises automatically monitoring operating system services that create new files on the computer; automatically detecting creation of at least one file on the computer used to implement folder shortcuts; in response at least to automatically detecting creation of the at least one file used to implement folder shortcuts, automatically analyzing contents of the at least one file on the computer used to implement folder shortcuts; in response to the at least one file on the computer used to implement folder shortcuts comprising specific contents, automatically determining existence of a folder shortcut on the computer; and in response to automatically determining that the folder shortcut exists on the computer, performing at least one additional step to secure the computer against a process associated with the detected folder shortcut.