Patent ID: 7797747

Claim:
A computer-implemented method comprising: executing, on a processor, a malicious code detection application wherein said executing comprises: determining non-paged pool unused pages in a non-paged pool, wherein non-paged pool pages in said non-paged pool are not swapped to and from pagefiles; said non-paged pool pages are non-paged pool used pages and said non-paged pool unused pages; selecting a subset of said non-paged pool unused pages; flushing non-paged pool unused pages entries corresponding to said subset from a translation lookaside buffer (TLB); detecting a page fault associated with an attempted access to a page determining whether the page is within the non-paged pool unused pages in said non-paged pool; determining whether said page contains malicious code upon finding that the page is within the non-paged pool unused pages in said non-paged pool; and taking protective action, upon finding that the page contains malicious code, to protect a computer system from said malicious code.