Patent ID: 7992156

Claim:
A method to be performed by a computer having a memory and a processor, the method comprising: invoking a first system call from a user-level program operating in user space of the memory, the first system call being included in a system call table comprising references to a plurality of system calls of a kernel of an operating system, the first system call being a system call in the plurality of system calls, retrieving an address of the system call table from a kernel stack populated by the kernel as a result of invocation of the first system call by the user-level program, the kernel stack being located in a kernel space of the memory; using the address of the system call table to find a reference to a second system call in the system call table; modifying the system call table to intercept a call to the second system call, the second system call being called to operate on a file; and scanning the file for viruses before allowing the second system call to execute to completion.