Patent ID: 8925089

Claim:
A method for securing an electronic device, comprising: detecting, at a higher priority than all of one or more operating systems of the electronic device, presence of malicious code; determining whether the malicious code is included in an operating system component; in response to detecting the presence of malicious code in the operating system component, modifying, at a higher priority than all of one or more operating systems of the electronic device, the malicious code with trusted code for the operating system component; in response to detecting the presence of malicious code as residing outside of operating system components, modifying, at a higher priority than all of one or more operating systems of the electronic device, the malicious code as embodied in a memory of the electronic device such that an entity including the malicious code self-terminates; wherein: the modification includes insertion of a call to an operating system exit routine; and detecting the presence of malicious code as residing outside of operating system components includes detecting a difference in monitored file writes between an internal operating system monitor and external operating system monitor outside of the operating system; determining whether the malicious code is embodied in storage of the electronic device; performing corrective action upon the malicious code in storage of the electronic device based upon a determination that the malicious code is embodied in storage of the electronic device; identifying a related portion of memory associated with a memory location of the malicious code; and performing corrective action upon the related portion of memory.