A method and apparatus for detecting viral code that uses calls to an operating system to damage computer systems, computers and/or computer files is provided. The apparatus comprises a CPU emulator, a memory manager component and a monitor component. An artificial memory region spanning one or more...http://www.google.de/patents/US20020083334?utm_source=gb-gplus-sharePatent US20020083334 - Detection of viral code using emulation of operating system functions
