Patent ID: 7669059

Claim:
A method for detecting hostile software in a computer system comprising: storing a representation of configuration data associated with an operating system for the computer system obtained at a first time, wherein the stored representation of configuration data is encrypted prior to being stored; comparing the stored representation of the configuration data obtained at the first time with a representation of the configuration data associated with the operating system for the computer system obtained at a second time, wherein the operating system is actively operating at the second time; and if deviation is detected between the stored representation of the configuration data obtained at the first time and the representation of the configuration data obtained at the second time, automatically performing at least one remedial measure in response to the deviation detected, wherein the operating system continues to operate after the at least one remedial measure is performed, wherein the at least one remedial measure comprises determining a storage location associated with suspected executable code in the computer system and moving suspected executable code to a specified storage location for later evaluation, and wherein the at least one remedial measure further comprises determining whether the suspected executable is being executed, and if the suspected executable code is being executed, terminating the execution of the suspected executable code without first providing warning to the suspected executable code prior to terminating the execution to prevent the suspected executable code from performing one or more countermeasures.