Patent ID: 7941850

Claim:
A computer-implemented method comprising: executing, on a processor, a malicious code removal application, wherein said executing includes: hooking a creation function to permit interception of a recreation request; determining if an attempt to recreate a new instance of a requested resource via the recreation request made by an originating process, wherein said determining is performed prior to execution of the recreation request; and wherein were the recreation request executed, said recreation request would create the new instance of said requested resource whether or not said requested resource presently exists or previously existed; upon determining that said attempt to recreate a requested resource via a recreation request was made, determining if said requested resource is a suspicious resource; upon determining that said requested resource is said suspicious resource, stalling said recreation request; identifying, following the stalling, the originating process of said recreation request; upon identifying said originating process of said recreation request, determining if said originating process is a non-trusted originating process or a trusted originating process; upon determining that said originating process is said non-trusted originating process, determining if said non-trusted originating process is a known false positive module; upon a determination that said non-trusted originating process is not the known false positive module taking a protective action; and upon a determination that said non-trusted originating process is said known false positive module, taking no protective action.