Patent ID: 8407797

Claim:
A computer-implemented method to detect malware on a computing system, the method comprising: performing an accelerated emulation of an untrusted computer file by emulating a first code sequence of a plurality of code sequences of the untrusted computer file in a virtual environment; and in response to identifying a known code sequence in the untrusted computer file, executing outside the virtual environment a preexisting trusted routine functionally implementing the known code sequence, wherein identifying the known code sequence comprises: determining whether a current emulation address is a code flow change target address; selectively performing a code signature database search if the current emulation address is determined to be a code flow change target address, wherein performing the code signature database search comprises searching a code signature database for a match to a content at the current emulation address to determine whether the content at the current emulation address forms part of the known code sequence; and determining whether the untrusted computer file is malicious according to a result of the accelerated emulation.