Methods for combating malicious software

A computer-implemented method for combating malware on a computer comprising a CPU, a memory, and a digital storage medium, the method comprising:

• a) monitoring all attempts by any software executing on the computer to write data to the digital storage medium;
• b) recording details of the attempts in a system database;
• wherein the details of the attempts comprise
• i) a first object identifier corresponding to an executable object attempting to write the data,
• ii) a second object identifier corresponding to a target object stored on the digital storage medium that the executable object is attempting to write data to, and
• iii) a third object identifier corresponding to a parent executable object that initiated execution of the executable object attempting to write the data,
• wherein the system database has a causal tree structure, where branch points represent parent executable objects from which child derivative objects are created and leaves represent child objects that have no derivative object;
• c) organizing the system database into software packages comprising groups of associated objects, wherein the software packages correspond to sub-trees of the causal tree structure;
• d) intercepting modification by executing objects to the memory allocated to other executing objects, and authorizing the modification for executing objects that are included in a predetermined exempt list stored in the system database;
• and
• e) intercepting unauthorized attempts by executing objects to modify a selected set of protected objects stored on the digital storage medium, wherein the selected set of protected objects comprises the system database.