Patent ID: 7293290

Claim:
A method for detecting malicious computer code in a host computer, the method comprising the steps of: identifying a port of a host computer from which executable content does not normally exit the host computer; determining whether outbound executable content is addressed to exit the identified port; calculating hashes of strings within the outbound executable content; comparing the calculated hashes with prestored hashes of strings stored within a runtime database of executable threads, when outbound executable content is addressed to exit the identified port, determining whether a calculated hash matches a prestored hash, and, when a calculated hash matches a prestored hash, determining whether a string from the runtime database is present in the outbound executable content, wherein said runtime database is generated in real time by a thread analyzer that analyzes threads being executed on the host computer; and when a string from the runtime database is present in the outbound executable content, declaring a suspicion of presence of malicious computer code in the outbound executable content.