Patent ID: 7707558

Claim:
A computer-implemented method, comprising: applying a hook on a kernel of an operating system; monitoring system calls made to the kernel using the hook; identifying a create process system call to create a new process using the hook, wherein upon receipt of the create process system call by the kernel, a loader of the operating system is directed to create the new process comprising: assembling a list of files to be loaded for the new process, the list of files comprising: system files common to all processes; and process specific files specific to the new process; injecting a new entry into the list of files assembled by the loader to create the new process comprising copying a new file into the list of files such that the copied new file will be loaded prior to loading of the process specific files; loading the copied new file prior to the loading of the process specific files, wherein upon being loaded, the copied new file is operable to examine the process specific files for security threats prior to the loading of the process specific files; and removing the security threats in the list of files but not removing any process specific files in the list of files.