US Patent 8056134 Malware detection and identification via malware spoofing

A malware spoof component may be a formed component which has some but not all characteristics of an actual malware file or other component. Alternately, a spoof component may be an isolated component extracted from actual malware. Malware spoof components may be placed on a target system, after which a listing is obtained and checked. If the placed spoof component does not appear in the listing, then the spoof component may have been filtered out by malware infecting the system, thereby revealing the malware's presence.