Automated identification and clean-up of malicious computer code

• US 20040187010A1
• Filed: 03/18/2003
• Published: 09/23/2004
• Est. Priority Date: 03/18/2003
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Bonhaus, Daryl, Anderson, W. Kyle
• Granted Patent: US 7,546,638 B2
• Time in Patent Office: Days
• US Class Current: 713/188
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

Malicious computer code (101) is automatically cleaned-up from a target computer (103). An operating system (109) automatically boots (201) in the computer memory (105) of the target computer (103). The booted operating system (109) automatically runs (203) a malicious code processing script (113) in the computer memory (105) of the target computer (103), under control of the booted operating system (109). The malicious code processing script (113) automatically copies (205) and runs (207) at least one malicious code clean-up script (115). At least one malicious code clean-up script (115) automatically cleans-up (209) malicious code (101) from the target computer (103).

Claims

1. A computer implemented method for automatically cleaning-up malicious computer code from a target computer, the target computer having computer memory and an associated operating system, the method comprising the steps of:

automatically booting an operating system in the computer memory of the target computer from computer readable media, the booted operating system comprising an operating system other than the operating system associated with the target computer;

the booted operating system automatically running a malicious code processing script in the computer memory of the target computer, under control of the booted operating system;

the malicious code processing script automatically copying at least one malicious code clean-up script from a location;

the malicious code processing script automatically running at least one copied malicious code clean-up script in the computer memory of the target computer; and

at least one malicious code clean-up script automatically cleaning-up malicious code from the target computer.

2. The method of claim 1 further comprising:

the malicious code processing script automatically copying a plurality of most recent available malicious code clean-up scripts from a location; and

the malicious code processing script automatically running each malicious code clean-up script of the plurality in the computer memory of the target computer.

3. The method of claim 1, further comprising the step of:

the malicious code processing script automatically copying a scanner from a location;

the malicious code processing script automatically running the scanner in the computer memory of the target computer;

the scanner automatically identifying malicious code that has infected the target computer; and

the malicious code processing script automatically copying at least one specific malicious code clean-up script from a location in order to clean-up the malicious code identified by the scanner.

4. The method of claim 1, further comprising the steps of:

the malicious code processing script reading system information from the target computer, in order to determine whether the target computer has access to any remotely mountable file systems;

the malicious code processing script, responsive to determining that the target computer has access to at least one remotely mountable file system, mounting at least one remotely mountable file system to which the target computer has access; and

at least one malicious code clean-up script automatically cleaning-up malicious code from at least one remotely mounted file system.

5. The method of claim 1 wherein:

the booted operating system comprises a version of Linux, and the operating system associated with the target computer comprises a version of Microsoft Windows.

6. The method of claim 1, 2 or 3 wherein:

the location comprises a remote server computer.

7. The method of claim 6 further comprising the steps of:

the malicious code processing script prompting a user for connectivity information needed in order to establish a network connection; and

the malicious code processing script using the provided connectivity information to establish a network connection.

8. The method of claim 1, 2 or 3 wherein:

the location comprises a removable computer media.

21. The method of claim 1 wherein the computer readable media from which the operating system is automatically booted comprises a computer readable media from the group of computer readable media comprising:

a removable computer readable media;

a remote computer readable media; and

a separate partition on the target computer.

9. A computer readable medium containing a computer program product for automatically cleaning-up malicious computer code from a target computer, the target computer having computer memory and an associated operating system, the computer program product comprising:

program code for enabling an operating system to automatically boot in the computer memory of the target computer, from computer readable media, the booted operating system comprising an operating system other than the operating system associated with the target computer;

program code for enabling the booted operating system to automatically run a malicious code processing script in the computer memory of the target computer, under control of the booted operating system;

program code for automatically copying at least one malicious code clean-up script from a location;

program code for automatically running at least one copied malicious code clean-up script in the computer memory of the target computer; and

program code for automatically cleaning-up malicious code from the target computer.

10. The computer program product of claim 9 further comprising:

program code for automatically copying a plurality of most recent available malicious code clean-up scripts from a location; and

program code for automatically running each malicious code clean-up script of the plurality in the computer memory of the target computer.

11. The computer program product of claim 9, further comprising:

program code for automatically copying a scanner from a location;

program code for automatically running the scanner in the computer memory of the target computer;

program code for automatically identifying malicious code that has infected the target computer; and

program code for automatically copying at least one specific malicious code clean-up script from a location in order to clean-up the malicious code identified by the scanner.

12. The computer program product of claim 9, further comprising:

program code for reading system information from the target computer, in order to determine whether the target computer has access to any remotely mountable file systems;

program code for mounting at least one remotely mountable file system to which the target computer has access; and

program code for automatically cleaning-up malicious code from at least one remotely mounted file system.

13. The computer program product of claim 9, 10 or 11 wherein:

the location comprises a remote server computer.

14. The computer program product of claim 13 further comprising:

program code for prompting a user for connectivity information needed in order to establish a network connection; and

program code for using the provided connectivity information to establish a network connection.

15. The computer program product of claim 9, 10 or 11 wherein:

the location comprises a removable computer media.

16. A computer system for automatically cleaning-up malicious computer code from a target computer, the target computer having computer memory and an associated operating system, the computer system comprising:

an operating system booting module, for automatically booting an operating system in the computer memory of the target computer from computer readable media, the booted operating system comprising an operating system other than the operating system associated with the target computer;

a script running module, for automatically running a malicious code processing script in the computer memory of the target computer, under control of the booted operating system, and for automatically running at least one malicious code clean-up script in the computer memory of the target computer, the script running module being communicatively coupled to the operating system booting module;

a script copying module, for automatically copying at least one malicious code clean-up script from a location, the script copying module being communicatively coupled to the script running module; and

a malicious code clean-up module, for automatically cleaning-up-malicious code from the target computer, the malicious code clean-up module being communicatively coupled to the script running module.

17. The computer system of claim 16, wherein:

the script copying module is further adapted to for automatically copy a plurality of most recent available malicious code clean-up scripts from a location; and

the script running module is further adapted to automatically run each malicious code clean-up script of the plurality in the computer memory of the target computer.

18. The computer system of claim 16, further comprising:

a scanning module for automatically identifying malicious code that has infected the target computer, the scanning module being communicatively coupled to the script copying module, and to the script running module; and

wherein;

the script copying module is further adapted to automatically copy the scanning module from a location, and for automatically copying at least one specific malicious code clean-up script from a location in order to clean-up the malicious code identified by the scanning module; and

the script running module is further adapted to automatically run the scanning module in the computer memory of the target computer.

19. The computer system of claim 16, 17 or 18 wherein:

the location comprises a remote server computer.

20. The computer system of claim 16, 17 or 18 wherein:

the location comprises a removable computer media.