Patent ID: 8065736

Claim:
A method for using asynchronous changes to memory to detect malware, said method comprising: employing at least one processor configured to execute computer-executable instructions stored in memory to perform the following acts: receiving a memory buffer location to be evaluated, said memory buffer location possibly being subverted by at least a portion of malware; performing a plurality of double fetches to said memory buffer location, wherein each of the plurality of double fetches comprises a first fetch used for inspection of buffer contents in the memory buffer location, and a second fetch used by a legitimate system call to detect changes in the buffer contents made by the malware; and comparing a plurality of responses to said plurality of double fetches, wherein a plurality of similar responses to said plurality of double fetches indicates said portion of malware is not present and wherein at least two different responses to said plurality of double fetches indicates said portion of malware is present.