Patent ID: 8627305

Claim:
A computer program product embodied on a non-transitory computer readable medium comprising instructions stored thereon to cause one or more processors to: identify creation of a process; insert code into an address space of the process prior to execution of the process; insert a first hook into an entry point of an executable of the process, the first hook pointing to the inserted code; identify whether the first hook has executed; wherein if the first hook has not executed, then: identify at least one library module being loaded in association with the process; determine whether the at least one library module is related to the execution of the inserted code; and insert a subsequent hook into an entry point of the at least one library module when it is determined that the at least one library module is not related to the execution of the inserted code, the subsequent hook pointing to the inserted code, wherein the instructions to identify at least one library module, determine, and insert a subsequent hook are repeated for one or more libraries being loaded in association with the process until it is determined that the first hook or the subsequent hook has executed; and remove each subsequent hook placed at the entry point of the at least one library module, in response to the execution of the inserted code.