Remediating effects of an undesired application

• US 20060179484A1
• Filed: 02/09/2005
• Published: 08/10/2006
• Est. Priority Date: 02/09/2005
• Status: Abandoned Application

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Madden, Daniel, Scrimsher, John P.
• Application Number:
  US11/054,028
• Publication Number:
  US 20060179484A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files

Abstract

Remediating effects of an undesired application. A remediation system comprises a script generator and a fix tool builder. The script generator is able to generate a script comprising remediation information corresponding to one or more actions for remediating one or more effects of the undesired application. The fix tool builder is able to generate a fix tool for performing the actions.

Claims

1. A system for remediating effects of an undesired application, comprising:

a script generator able to generate a script comprising remediation information corresponding to one or more actions for remediating one or more effects of the undesired application, and

a fix tool builder able to generate a fix tool for performing the one or more actions.

2. The system of claim 1 wherein the undesired application comprises malware.

3. The system of claim 1 wherein the script comprises statements in an extensible markup language.

4. The system of claim 1 wherein the script generator further comprises an administration application able to receive descriptive information concerning the one or more effects.

5. The system of claim 4 wherein the descriptive information comprises one or more entries in a log.

6. The system of claim 5 wherein the log comprises statements in an extensible markup language.

7. The system of claim 5 wherein the administration application is able to import the log.

8. The system of claim 4 wherein the administration application comprises an administration interface for receiving at least a portion of the descriptive information.

9. The system of claim 4 wherein the administration application comprises an administration interface for editing the descriptive information.

10. The system of claim 1 further comprising a monitoring driver able to hook one or more system calls of the undesired application.

11. The system of claim 1 further comprising a monitoring application able to receive descriptive information concerning one or more system calls of the undesired application, and able to generate a log comprising descriptive information concerning the one or more effects.

12. The system of claim 11 further comprising

a monitoring driver able to hook the one or more system calls for providing the descriptive information to the monitoring application.

13. The system of claim 1 further comprising a user interface able to receive at least a portion of the remediation information.

14. The system of claim 13 wherein the user interface comprises a capability for editing the script.

15. The system of claim 1 wherein the fix tool comprises the script and an actor application able to read the script and perform the actions.

16. The system of claim 1 wherein the fix tool comprises an actor application able to perform the one or more actions.

17. A system for remediating effects of an undesired application, comprising

an analysis application able to receive descriptive information concerning one or more effects of the undesired application, and

a script generator able to use the descriptive information for generating a script comprising remediation information describing one or more actions for remediating the one or more effects.

18. The system of claim 17 wherein the descriptive information comprises one or more entries in a log.

19. The system of claim 17 further comprising a monitoring driver for providing the descriptive information.

20. The system of claim 19 wherein the monitoring driver is able to hook one or more system calls.

21. The system of claim 17 wherein the analysis application comprises a viewing interface for displaying at least a portion of the descriptive information.

22. The system of claim 17 wherein the analysis application comprises an editing interface for modifying at least a portion of the descriptive information.

23. The system of claim 17 wherein the script generator comprises an editing interface for modifying at least a portion of the remediation information.

24. A monitoring system for effects of an undesired application, comprising

a monitoring driver able to hook one or more system calls of the undesired application,

one or more hook functions for gathering descriptive information concerning the one or more system calls potentially affected in a malicious way by the undesired application, and

a monitoring application able to receive the descriptive information, and able to generate a log comprising descriptive information concerning the one or more potentially malicious effects.

25. The system of claim 24 wherein the monitoring application comprises a viewing interface for displaying at least a portion of the descriptive information.

26. The system of claim 24 wherein the monitoring application comprises an editing interface for modifying at least a portion of the descriptive information.

27. A method for remediating effects of an undesired application, comprising

providing one or more hook functions,

hooking one or more system calls,

gathering descriptive information concerning the one or more system calls,

generating a log comprising at least a portion of the descriptive information,

generating a script comprising remediation information for at least a portion of the log, and

building a fix tool able to perform remediation actions according to the script.

28. The method of claim 27 further comprising reviewing the log.

29. The method of claim 27 further comprising editing the script.

30. The method of claim 27 further comprising performing remediation actions according to the script.

31. The method of claim 27 wherein the remediation actions include removing the undesired application.

32. A fix tool built according to the method of claim 27.

33. A computer-readable medium containing a set of instructions for remediating effects of an undesired application, the set of instructions comprising steps for:

providing one or more hook functions,

hooking one or more system calls,

gathering descriptive information concerning the one or more system calls,

generating a log comprising at least a portion of the descriptive information,

generating a script comprising remediation information for at least a portion of the log, and

building a fix tool able to perform remediation actions according to the script.

34. The medium of claim 33, the set of instructions further comprising steps for providing a graphical interface for viewing the log.

35. The medium of claim 33, the set of instructions further comprising steps for providing a graphical interface for editing the script.

36. A remediation tool for remediating effects of an undesired application, comprising

a script comprising remediation information for remediating one or more effects of the undesired application, and

an actor application able to perform one or more actions described in the script.

37. The remediation tool of claim 36 wherein the script comprises statements in an extensible markup language.

38. The remediation tool of claim 36 wherein a self-extracting executable file contains the actor application.

39. The remediation tool of claim 38 wherein the self-extracting executable file contains the script.

40. The remediation tool of claim 36 wherein the actor application is configured to display descriptive information relating to the one or more actions.

41. The remediation tool of claim 36 wherein the actor application is configured to log descriptive information relating to performance of the one or more actions.