Patent ID: 8225394

Claim:
A method for detecting malware using a secure operating system mode, comprising: Receiving, by a client computer system, a file; determining that the file is an executable; storing the file in a secure directory; preventing at least one operation on the file; and in response to determining that the file is the executable, prompting a user to reboot the operating system of the client computer system; and in response to the user rebooting the client computer system, starting the secure operating system mode to detect whether the file comprises the malware by comparing the file to one or more permitted files while the operating system of the client computer system is in the secure operating system mode, and wherein starting the secure operating system mode to detect whether the file comprises the malware further comprises detecting whether the file comprises the malware by comparing the file to one or more permitted files while an operating system of the client computer system is in the secure operating system mode by performing booting or rebooting an operating system of the client to change the operating system from a default unsecured mode to the secure operating system mode.