METHOD AND APPARATUS FOR DETECTING SHELLCODE INSERTION

A method of detecting malware present on a computer system where the computer system is running an application. The method includes redirecting a function call, made by the application to a decoding function that performs decoding of an argument provided to it by an application, to a scanning function. The scanning function is then employed to scan an argument of the function call for suspect code or data. In the event that suspect code or data is detected, the function call is inhibited, otherwise program control is returned to the called decoding function.