Robust malware detector

A method for detecting and diffusing malware on a computer, the method comprising the steps of:

• processing at least one malware sample on at least one server side computer;
• forming a signature for each malware sample having at least one stop call at a fixing moment;
• distributing the signature to at least one client side computer;
• hooking all of the system calls of the operating system of the client side computer;
• processing all of the hooked system calls through a filter to remove system calls not associated with malware;
• accumulating the system calls not removed by the filter process on a per-thread basis;
• checking the system calls not removed by the filter for a stop call;
• comparing the thread associated with the stop call to the signature for a match with malware;
• and
• addressing the thread matched with malware at the fixing moment.

A non-transitory computer readable medium comprising software comprising:

• code for processing at least one malware sample on at least one server side computer;
• code for forming a signature for each malware sample having at least one stop call at a fixing moment;
• code for distributing the signature to at least one client side computer;
• code for hooking all of the system calls of the operating system of the client side computer;
• code for processing all of the hooked system calls through a filter to remove system calls not associated with malware;
• code for accumulating the system calls not removed by the filter process on a per-thread basis;
• code for checking the system calls not removed by the filter for a stop call;
• code for comparing the threads associated with the stop call to the signature for a match with malware;
• and
• code for addressing the thread matched with malware at the fixing moment.