Patent ID: 6907396

Claim:
A method for emulating computer viruses and/or malicious software that operates by patching additional program instructions into an emulator in order to aid in detecting a computer virus and/or malicious software within suspect code, the method comprising: receiving the suspect code; loading the suspect code into an emulator buffer within a data space of a computer system; loading a first emulator extension into the emulator, the emulator capable of performing an emulation using emulation code, the first emulator extension including program instructions that aid in the process of emulating the suspect code in order to detect a computer virus and/or malicious software, wherein the program instructions of the first emulator extension are additional beyond that associated with the emulator code, for assisting the emulator code in the emulation by patching the additional program instructions into the emulator in order to aid in detecting the computer virus and/or malicious software within the suspect code; performing the emulation using the first emulator extension, the emulation code and the suspect code, the emulation being performed within an insulated environment in the computer system so that the computer system is insulated from malicious actions of the suspect code; and determining whether the suspect code is likely to exhibit malicious behavior based upon the emulation.