Safe memory scanning

A method comprising:

• hooking a driver unload function of an operating system;
• stalling any calls to the driver unload function;
• querying a driver name list from the operating system;
• receiving the driver name list, the driver name list including one or more loaded drivers and corresponding load addresses;
• scanning the one or more loaded drivers for viruses;
• and
• allowing the any calls to proceed to the driver unload function after the scanning is complete.

A computer system comprising:

• a means for hooking a driver unload function of an operating system;
• a means for stalling any calls to the driver unload function;
• a means for querying a driver name list from the operating system;
• a means for receiving the driver name list, the driver name list including one or more loaded drivers and corresponding load addresses;
• a means for scanning the one or more loaded drivers for viruses;
• and
• a means for allowing the any calls to proceed to the driver unload function.

A computer program product comprising a computer-readable medium containing computer program code for a method comprising:

• preventing an unload of at least one loaded driver from a memory of a computer system;
• scanning in a kernel mode the at least one loaded driver for viruses;
• and
• permitting the unload of the at least one loaded driver from the memory of the computer system after the scanning is complete.

A computer program product comprising a computer-readable medium containing computer program code for a method comprising:

• hooking a driver unload function of an operating system;
• stalling any calls to the driver unload function;
• querying a driver name list from the operating system;
• receiving the driver name list, the driver name list including one or more loaded drivers and corresponding load addresses;
• scanning the one or more loaded drivers for viruses;
• and
• allowing the any calls to proceed to the driver unload function after the scanning is complete.