Patent ID: 7603614

Claim:
A method for indicating an executable as a Trojan Horse, the executable having code and including a plurality of routines, the method comprising: executing instructions by one or more computer processors to effect the following: (a) gathering in a database information related to a CRC value of at least one routine of at least one known Trojan Horse; (b) for each routine of the plurality of routines, (i) scanning the code of the executable for respective first and second borders of said each routine; (ii) detecting a respective beginning and a respective end of said each routine according to said respective first and second borders; (iii) identifying respective code located between said respective beginning and end as code of said each routine; and (iv) calculating a respective CRC value of said each identified respective code, thereby calculating a respective CRC value for said each routine; and (c) indicating whether the executable is a Trojan Horse according to a correspondence of at least one said calculated CRC value that is calculated from the executable to said information in said database.