Patent ID: 8528087

Claim:
A computer-implemented method for combating malware on a computer comprising a CPU, a memory, and a digital storage medium, the method comprising: a) monitoring all attempts by any software executing on the computer to write data to the digital storage medium; b) recording details of the attempts in a system database; wherein the details of the attempts comprise i) a first object identifier corresponding to an executable object attempting to write the data, ii) a second object identifier corresponding to a target object stored on the digital storage medium that the executable object is attempting to write data to, and iii) a third object identifier corresponding to a parent executable object that initiated execution of the executable object attempting to write the data, wherein the system database has a causal tree structure, where branch points represent parent executable objects from which child derivative objects are created and leaves represent child objects that have no derivative object; c) organizing the system database into software packages comprising groups of associated objects, wherein the software packages correspond to sub-trees of the causal tree structure; d) intercepting modification by executing objects to the memory allocated to other executing objects, and authorizing the modification for executing objects that are included in a predetermined exempt list stored in the system database; and e) intercepting unauthorized attempts by executing objects to modify a selected set of protected objects stored on the digital storage medium, wherein the selected set of protected objects comprises the system database.