Patent ID: 8549648

Claim:
A system for protecting an electronic device against malware, comprising: one or more system resources of the electronic device; one or more operating systems of the electronic device; a first security module configured to execute on the electronic device at a level below all of the operating systems of the electronic device accessing the one or more system resources; and a second security module configured to enumerate one or more processes running on the electronic device, the one or more processes visible to the operating system; wherein the first security module is configured to: trap one or more attempts to access system resources of the electronic device, the one or more attempts made from a less privileged ring of execution than the first security module; record information identifying one or more processes attempting to access the system resources of the electronic device; compare the information identifying one or more processes attempting to access the system resources with the enumerated one or more processes visible to the operating system; and based on the comparison, determine one or more hidden processes, the hidden processes determined by at least identifying processes whose information was recorded by first security module but were not enumerated by the second security module; wherein: the trapped attempts include an attempt to access a register configured to translate a virtual memory address into a physical memory address; and information identifying one or more processes is recorded based upon the attempted access of the register.