Patent ID: 7836504

Claim:
A computer-implemented method for identifying malware from pages of information temporarily stored in a memory, the method comprising: regulating the ability of a computer-executable process to access the information pages stored in the memory; when the computer-executable process requests access to the information pages in a non-regulated manner, complying with the request; when the computer-executable process requests access to the information pages in a regulated manner, handling the request through execution of a software routine stored in a memory; prior to scanning for malware, accessing each information page to determine whether each information page is capable of exposing the computer to malware, wherein pages capable of exposing the computer to malware cause a state change, generate an interrupt, or are otherwise executable, such that only information pages that are capable of exposing the computer to malware are scanned for malware and pages that are incapable of exposing the computer system to malware are not scanned for malware; and upon determining that the accessed information page is capable of exposing the computer to malware, performing the following: deferring scanning the accessed information page for malware by tracking a state of the information page stored in the memory until the computer system determines that the information page is in a not-safe state, the not-safe state comprising at least one of when the information page is first loaded into the memory and when the information page is modified while in memory, wherein the not-safe state indicates the information page is potentially infected with malware; and based on a determination that the information page is in a not-safe state, scanning the information page stored in the memory for malware, when scanning the information page stored in the memory identifies malware, removing the malware before execution of the computer-executable process continues, wherein scanning the information page includes matching patterns of the information page to a malware signature.