Patent ID: 8453242

Claim:
A method of detecting malware in a system, the method comprising: receiving, at a filter driver positioned between an operating system for the system and applications or files in the system, requests for resources from the applications or files; relaying the requests to the operating system; receiving, at the filter driver, responses to the requests, the responses including handles; recording, by the filter driver, information associated with the handles in a handle list, wherein the recorded information comprises handle names associated with the handles included in the responses; relaying, from the filter driver, the responses to the applications or files, the applications or files opening the handles; detecting potential malicious code associated with the malware by determining whether the handle names recorded in the handle list are capable of being created by code associated with malware; obtaining information associated with the open handles directly from the operating system of the system, wherein obtaining information comprises using function calls to an application program interface for the operating system of the system, wherein obtaining the information associated with the open handles directly from the operating system of the system further comprises: sending, by a virus scanning engine, a function call to the application program interface for the operating system; and receiving, by the virus scanning engine and in response to the function call, information associated with open handles in the system directly from the operating system; and comparing the recorded information from the filter driver and the obtained information directly from the operating system for deviations to detect malicious code potentially stealthed from inclusion in the recorded information or the obtained information.