Patent ID: 8387139

Claim:
A method for disabling malicious functionality in a thread that is injected into a process running on a computer system, the method comprising the steps of: receiving, by the computer system comprising at least one memory, identification of named processes in which malware code is suspected to have been injected; generating a query arranged for identifying threads associated with the named processes; extracting a start address location in the named processes' memory for each of the threads; searching for additional locations invoked by the start address for each of the threads, the searching comprising: forming a memory address queue wherein a start point of the queue is the start address location; removing an address from the queue when that address is inside a block on a block list; examining machine code at the address when the address is not inside the block list, the machine code being examined to identify new addresses; and adding the new addresses to the queue if the machine code jumps to the new addresses or adding a block of code to the block list when end of the block is found; responsive to the searching, listing the blocks of code that are associated with the threads; matching the blocks of code with blocks in a thread scanning signature to determine if a thread is infected with malware, the thread scanning signature defining partial contents of blocks of memory; and declaring the thread as infected if identified blocks of code match all the blocks in the thread scanning signature.