Patent ID: 8104090

Claim:
A method for identifying malware components on a computer, the method comprising: (a) detecting an attempt by a process to create or modify an executable file or an attempt to write to a system registry; (b) logging the attempt as an auditable event; (c) performing a malware check on executable files of the computer, (d) if malware is detected on the computer, identifying files created or modified by the process of step (a), and identifying processes related to the auditable event, including processes having a parent-child relationship to the process of step (a), in an upwards direction of the parent-child tree, and identifying files created or modified by processes that belong the parent-child tree of the process of step (a); (e) terminating the processes related to the auditable event; (f) deleting or quarantining the executable files identified in step (d); and (g) for any deleted executable system files, restoring the executable system files from a trusted backup, wherein a log of auditable events is maintained, the log including a record of all the files and processes identified in step (d), wherein the log is recoverable after system reboot, including recovery of information relating to the files identified in step (d).