Patent ID: 8191147

Claim:
A computer-implemented method comprising: detecting a malicious network signature on a host computer system, the detection being accomplished through an examination of inbound data packets from a network coupled to the host computer system, said malicious network signature being associated with a malicious code; determining whether or not said malicious network signature is associated with malicious code, the determination taking place through a process comprising: identifying, by reviewing the malicious network signature, and data associated with the malicious network signature, one or more residual artifacts required to be present within the host computer system, in order for a malicious detection to be validated, wherein the system is configured to determine a residual artifact comprising a registry entry, the act of determination being triggered based on whether the requirement for the registry entry is specified within the malicious network signature; determining that at least one of the one or more identified residual artifacts are present within the host computer system, thus validating the malicious detection; and wherein upon a determination that said malicious network signature is validated, locating said malicious code on said host computer system, and removing said malicious code from said host computer system.