Run-time additive disinfection

A computer program product embodied in a computer readable medium that, when executing on one or more computers, performs the steps of:

• identifying, based at least in part on its type, an executable software application that is suspected of being infected with malware, wherein the malware is adapted to perform a function during the execution of the executable software application;
• predicting the malware function based on known patterns of malware infection relating to the type of executable software application;
• and
• in response to the prediction, adding a remediation software component to the executable software application that disables the executable software component from executing code that performs the predicted malware function.

A computer program product embodied in a computer readable medium that, when executing on one or more computers, performs the steps of:

• identifying an executable software application that is suspected of being infected with malware, wherein the malware is adapted to perform a function during the execution of the executable software application;
• predicting the malware function based on known patterns of malware infection relating to the executable software application;
• and
• in response to the prediction, adding a remediation software component to the executable software application that disables the executable software component from executing code that performs the predicted malware function.