DETERMINING THE ADDRESS OF A SYSTEM CALL TABLE TO PERFORM ANTIVIRUS TASKS IN A COMPUTER

In one embodiment, an address of a system call table is determined by invoking a first system call from a user-level program running in user space. When the first system call executes, the first system call retrieves the address of the system call table from kernel stack, which that has been populated by the kernel with various data including the address of the system call table. Using the retrieved address to locate the system call table, the system call table is modified to allow interception of calls made to one or more system calls included in the system call table. This allows a scan module to scan data for computer viruses before a system call is allowed to execute and operate on the data, for example.