Abstract: According to an embodiment of the invention a method of detecting malware in a system comprises positioning a filter driver between an operating system for the system and applications or files in the system. The filter driver receives requests for resources from the applications or files and relays the requests to the operating system. The filter driver receives responses to the requests, which include handles; records information associated with the handles in a handle list; and relays the responses to the applications or files, which open the handles. Potential malicious code is detected by analyzing information associated with the open handles. In particular embodiments, analyzing information associated with the open handles may comprise analyzing system resources referenced by the open handles.

Abstract: A method and apparatus for detecting script language viruses is provided. The apparatus includes a script language processor, a detection data processor and a detection engine. The script language processor prepares language description data corresponding to at least one script language. The detection data processor prepares detection data for viral code corresponding to the script language virus. The detection engine lexically analyzes a data stream using the language description data and the detection data to detect the viral code. The language description data may correspond to language definition rules and language check rules. The data stream may be converted to a stream of tokens, wherein the lexical analysis is performed on the token stream. The script language virus detection apparatus may be a computer program stored on a computer readable medium and/or transmitted via a computer network or other transmission medium.

Abstract: According to an embodiment of the invention a method of detecting malware in a system comprises positioning a filter driver between an operating system for the system and applications or files in the system. The filter driver receives requests for resources from the applications or files and relays the requests to the operating system. The filter driver receives responses to the requests, which include handles; records information associated with the handles in a handle list; and relays the responses to the applications or files, which open the handles. Potential malicious code is detected by analyzing information associated with the open handles. In particular embodiments, analyzing information associated with the open handles may comprise analyzing system resources referenced by the open handles.

Abstract: A method and apparatus for detecting script language viruses is provided. The apparatus includes a script language processor, a detection data processor and a detection engine. The script language processor prepares language description data corresponding to at least one script language. The detection data processor prepares detection data for viral code corresponding to the script language virus. The detection engine lexically analyzes a data stream using the language description data and the detection data to detect the viral code. The language description data may correspond to language definition rules and language check rules. The data stream may be converted to a stream of tokens, wherein the lexical analysis is performed on the token stream. The script language virus detection apparatus may be a computer program stored on a computer readable medium and/or transmitted via a computer network or other transmission medium.