System, method and computer program product for accelerating malware/spyware scanning

• US 20060075502A1
• Filed: 12/13/2004
• Published: 04/06/2006
• Est. Priority Date: 09/27/2004
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Edwards, Jonathan L.
• Granted Patent: US 7,984,503 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A system, method and computer program product are provided for scanning files. A plurality of file names in a registry of a computer is identified. By this identification, files associated with the file names are scanned. Another system, method and computer program product are further provided. In particular, a change in a registry of a computer is first identified. Then, a scan is conditionally performed based on whether the change in the registry is identified.

Claims

1. A method for scanning files, comprising:

identifying a plurality of file names in a registry of a computer; and

scanning files associated with the file names.

2. The method as recited in claim 1, wherein the file names are identified utilizing a predetermined format associated therewith.

3. The method as recited in claim 2, wherein the format includes a path.

4. The method as recited in claim 3, wherein the path includes a drive letter.

5. The method as recited in claim 1, wherein duplicate file names are removed.

6. The method as recited in claim 1, wherein the files are scanned for malware.

7. The method as recited in claim 1, wherein the files are scanned for spyware.

8. The method as recited in claim 7, wherein the spyware includes adware.

9. The method as recited in claim 7, wherein the spyware includes dialer software.

10. The method as recited in claim 1, wherein a first time required for the scanning is less than a second time required for scanning files stored on harddisks of the computer.

11. The method as recited in claim 1, wherein the registry includes a location on the computer for storing information selected from a group consisting of hardware that is attached to the computer, system options that have been selected, a configuration of memory of the computer, and application programs to be present when an operating system of the computer is started.

12. The method as recited in claim 1, wherein the registry includes a location on the at least one computer for storing information including hardware that is attached to the computer, system options that have been selected, a configuration of memory of the computer, and application programs to be present when an operating system of the computer is started.

13. The method as recited in claim 1, wherein the method is utilized to counter terrorism.

14. A computer program product embodied on a computer readable medium for scanning files, comprising:

computer code for identifying a plurality of file names in a registry of a computer; and

computer code for scanning files associated with the file names.

15. A system for scanning files, comprising:

means for identifying a plurality of file names in a registry of a computer; and

means for scanning files associated with the file names.

16. A method, comprising:

identifying a change in a registry of a computer; and

conditionally performing a scan based on whether the change in the registry is identified.

17. The method as recited in claim 16, wherein a scheduled scan is performed on a periodic basis.

18. The method as recited in claim 17, wherein the conditional scan is performed prior to the scheduled scan.

19. The method as recited in claim 18, wherein the conditional scan is performed in parallel with the scheduled scan.

20. The method as recited in claim 16, wherein the registry is continuously monitored for identifying the change.

21. The method as recited in claim 16, wherein the conditional scan includes scanning the registry.

22. The method as recited in claim 18, wherein the scanning of the registry includes scanning the registry for at least one predetermined key.

23. The method as recited in claim 22, wherein the at least one predetermined key is deleted upon the detection thereof.

24. The method as recited in claim 16, wherein the conditional scan includes scanning at least one file.

25. The method as recited in claim 24, wherein the conditional scan includes scanning each of a plurality of files identified in the registry.

26. The method as recited in claim 24, wherein the change includes a change to any file name in the registry.

27. The method as recited in claim 26, wherein the at least one file includes only files associated with a changed file name.

28. The method as recited in claim 16, wherein the registry is continuously monitored for identifying the change.

29. The method as recited in claim 16, wherein the scan includes scanning for malware.

30. The method as recited in claim 16, wherein the scan includes scanning for spyware.

31. The method as recited in claim 30, wherein the spyware includes adware.

32. The method as recited in claim 30, wherein the spyware includes dialer software.

33. The method as recited in claim 16, wherein a first time required for the scan is less than a second time required for scanning files stored on harddisks of the computer.

34. The method as recited in claim 16, wherein the registry includes a location on the computer for storing information selected from a group consisting of hardware that is attached to the computer, system options that have been selected, a configuration of memory of the computer, and application programs to be present when an operating system of the computer is started.

35. The method as recited in claim 16, wherein the registry includes a location on the at least one computer for storing information including hardware that is attached to the computer, system options that have been selected, a configuration of memory of the computer, and application programs to be present when an operating system of the computer is started.

36. The method as recited in claim 16, wherein the method is utilized to counter terrorism.

37. A computer program product embodied on a computer readable medium, comprising:

computer code for identifying a change in a registry of a computer; and

computer code for conditionally performing a scan based on whether the change in the registry is identified.

38. A system, comprising:

means for identifying a change in a registry of a computer; and

means for conditionally performing a scan based on whether the change in the registry is identified.

39. A method, comprising:

determining whether a scan is scheduled;

if it determined that the scan is scheduled;

identifying a plurality of file names in a registry of a computer,

removing duplicate file names in the registry of the computer, and

scanning files associated with the file names for spyware and malware;

identifying a change in the registry of the computer; and

if the change in the registry is identified;

identifying the file names in the registry of the computer,

removing the duplicate file names in the registry of the computer,

scanning the files associated with the file names for spyware and malware,

scanning the registry for predetermined keys, and

removing the predetermined keys.