Patent ID: 8832836

Claim:
A computer-implemented method operating in a computing device, the method comprising: receiving, at the computing device, a malware scan request comprising a type and version of an internet browser and one or more parameters, the one or more parameters comprising target uniform resource (URIs), uniform resource locators (URLs), and/or uniform resource names (URNs) used to identify web pages upon which malware scanning is to be performed; launching, in the computing device, a virtual machine in response to the received malware scan request; launching, in the virtual machine of the computing device and in response to the received malware scan request, an internet browser of the type and version; requesting, by the internet browser in the virtual machine and in response to the received malware scan request, data from the web page, over a network; performing, in the virtual machine of the computing device, analysis on the web page using one or more analysis tools, wherein performing the analysis includes: performing monitoring and recording of system application programming interface (API) calls, creating software objects associated with the web page, performing antivirus scanning of the software objects, and de-obfuscating code associated with the software objects; and correlating data associated with the analysis that is performed to determine if the web page is a malicious web page.