Patent ID: 8190868

Claim:
A method for managing pestware on a computer comprising: starting a boot sequence, the boot sequence including a period when boot drivers are initialized; initiating a kernel-level monitor during the period when boot drivers are initialized; monitoring, while the boot sequence is being carried out, events with the kernel-level monitor; managing pestware-related events with the kernel-level monitor before a period in the boot sequence when the computer is configured to run native applications, the period in the boot sequence when the computer is configured to run native applications being after a kernel is loaded and before a Win32 subsystem is loaded; loading and initializing a native scanner during the period in the boot sequence when the computer is configured to run native applications; managing pestware-related events during the period in the boot sequence when the computer is configured to run native applications; acquiring a set of behavior rules, wherein the managing pestware-related events is carried out in accordance with the behavior rules; and scanning, using the native scanner, a registry of the computer for pestware during the period in the boot sequence when the computer is configured to run native applications.