Methods and apparatus for defeating malware

An apparatus comprising:

• a machine-accessible medium;
• and
• instructions in the machine-accessible medium, wherein the instructions, when executed by a data processing system that supports a virtualization enabled (VE) operating mode, cause the data processing system to perform operations comprising:
• launching an operating system (OS) during a boot process in the data processing system;
• selecting a boot device for loading the OS;
• before selecting the boot device and before launching the OS, launching a trap agent;
• with the trap agent, intercepting an attempt to transition the data processing system to virtual machine (VM) operating mode after the OS has been launched;
• and
• in response to intercepting the attempt to transition the data processing system to VM operating mode, automatically determining whether a program that requested the transition is an authorized program.

A data processing system comprising:

• a processing unit that supports a virtualization enabled (VE) operating mode;
• non-volatile storage in communication with the processing unit;
• system read-only memory (ROM) in communication with the processing unit;
• and
• instructions in the system ROM, wherein the instructions, when executed, cause the data processing system to perform operations comprising:
• launching a trap agent before selecting a boot device for loading an operating system (OS) and before launching the OS during a boot process in the data processing system;
• with the trap agent, intercepting an attempt to transition the data processing system to virtual machine (VM) operating mode after the OS has been launched;
• and
• in response to intercepting the attempt to transition the data processing system to VM operating mode, automatically determining whether a program that requested the transition is an authorized program.