Patent ID: 8499349

Claim:
A method of detecting malware in a computer, said method comprising: detecting a file access operation by a monitor agent of said computer, said file access operation indicating a program of said computer attempting to modify a target file of said computer; saving, by said monitor agent, a file version number of said target file; determining whether said program has been digitally signed by a third party; allowing said program to modify said target file according to said file access operation; determining whether a new file version number of said modified target file matches said saved file version number; and alerting a user of said computer that said program is suspected of being malware when it is determined that said program has not been digitally signed and when it is determined that said new file version number matches said saved file version number and wherein said saving of said file version number of said target file is performed before said allowing of said program to modify said target file and after said detecting of said file access operation indicating said program attempting to modify said target file.