DISABLING EXECUTION OF MALWARE HAVING A SELF-DEFENSE MECHANISM

A dummy debugger program is installed within the user computer system. The dummy program is registered with the operating system as a debugger and may also be registered as a system service as if it is a kernel mode debugger. The dummy debugger program may have the name of a popular debugging program. Dummy registry keys are created that are typically used by a debugger to make it appear as if a debugger is present within the operating system of the user computer. Dummy program folders or dummy program names are created to make it appear as if a debugger is present within the operating system of the user computer. API calls are intercepted by using API hooks and modified to always return a meaningful value indicating that a debugger is present. Malware performing any checks to see if a debugger is present will be informed that a debugger is present and will then shutdown, sleep, terminate, etc. Or, in order to trick malware into thinking that an emulator is present, any API call is intercepted and the sleep time passed in is raised by a couple of milliseconds. Malware will determine that the time parameter passed in is not equivalent to the elapsed time from before the API call to after the call and the malware will determine that an emulator is present and will terminate.