US Patent 7797747 Detection of malicious code in non-paged pool unused pages

Subsets of non-paged pool unused pages entries are flushed from a translation lookaside buffer (TLB). An attempt to access malicious code within a not present page within the non-paged pool unused pages is made, e.g., by malicious code. The attempt to access the page generates a page fault, which is detected. The page is scanned for malicious code and a determination is made that the page contains malicious code. Protective action is taken to protect a host computer system from the malicious code. Accordingly, malicious code in a page marked not present, i.e., in a page that ordinarily would not be scanned for malicious code, is detected and defeated.