Patent ID: 8099785

Claim:
A method for treating a malware in a computer having multiple copies of the same malicious code activated, wherein the multiple copies monitor one another's existence, the method comprising: (a) identifying a presence of the malware on the computer by monitoring interprocess communication between multiple threads of the malware; (b) using an antivirus driver, blocking actions that permit one active copy of the malware to activate another copy of the malware, including blocking writes to executable files in a persistent storage and writes to a system registry, and including blocking launching of any new processes and writes to a system registry, wherein the blocking utilizes OS executable code that does not block activities of anti-malware software and permits only the antivirus driver to perform the writes; (c) deleting, from the persistent storage, a file containing executable code of the malware, and replacing the file with a non-infected copy; (d) deleting, from the system registry, keys corresponding to the malware; (e) maintaining the blocking until a reboot of the computer; and (f) warning a user about an impending reboot and terminating the blocking and any executing malware by forcing the reboot of the computer.