Patent ID: 7735100

Claim:
A computer implemented method for regulating remote registry access, the method comprising the steps of: a remote registry access manager on a first computer detecting an attempt by a process on the first computer to remotely access a second computer's registry via a remote registry access system call; the remote registry access manager determining whether the attempt to remotely access the second computer's registry is legitimate; and the remote registry access manager performing a step from a group of steps consisting of: responsive to determining that the attempt is legitimate: allowing the attempt to proceed, storing a registry key handle returned by the remote registry access system call, intercepting a local registry access system call, determining whether the local registry access system call is attempting to access a remote registry key through the stored handle, responsive to determining that the attempt to access the remote registry key through the stored handle is legitimate, allowing the attempt to access the remote registry key through the stored handle to proceed, and responsive to determining that the attempt to access the remote registry key through the stored handle is not legitimate, blocking the attempt to access the remote registry key through the stored handle; and responsive to determining that the attempt is not legitimate: blocking the attempt; logging the attempt; responsive at least in part to the process having made a plurality of blocked attempts, determining that the process comprises malicious code; responsive to determining that the process comprises malicious code, the remote registry access manager performing a step from a group of steps consisting of: executing a malicious code processing engine; informing an automatic malicious code manager of the malicious code; and informing a human user of the malicious code.