Abstract: A method and apparatus for detecting malware in network traffic is described. One embodiment executes, in an emulation environment, an executable file as it is being received serially over a network, execution beginning once a block of data including an entry point of the executable file has been received, execution halting whenever an instruction in the executable file references data not yet received and resuming once the data not yet received has been received, execution ceasing upon satisfaction of a termination condition; examining the emulation environment for indications that the executable file includes malware; and taking corrective action responsive to the results of examining the emulation environment for indications that the executable file includes malware.

Abstract: A method and system for scanning electronic data for predetermined data patterns is described. One embodiment reads the electronic data serially; consults, during the reading, an acceleration list, the acceleration list specifying one or more sections of the electronic data that are to be scanned for the predetermined data patterns, at least one predetermined data pattern being applicable to each of the one or more sections based, at least in part, on a predetermined data address range associated with the at least one predetermined data pattern lying within that section of the electronic data, the predetermined address range specifying a location of a potential occurrence, within the electronic data, of the at least one predetermined data pattern; scans for predetermined data patterns, during the reading, only the one or more sections of the electronic data specified in the acceleration list; and reports results of the scanning to a user.