System and method for identifying and removing pestware using a secondary operating system

• US 20070168694A1
• Filed: 01/18/2006
• Published: 07/19/2007
• Est. Priority Date: 01/18/2006
• Status: Abandoned Application

• Current Assignee: Webroot Software Incorporated (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Nichols, Tony, Maddaloni, Phil
• Application Number:
  US11/334,316
• Publication Number:
  US 20070168694A1
• Time in Patent Office: Days
• US Class Current: 714/4
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect

Abstract

Systems and methods for detecting and managing pestware are described. In one variation, a secondary operating system operates simultaneously with a primary operating system of a computer, and an anti-pestware application or service utilizes the secondary operating system to scan for indicia of pestware-related activity that may adversely affect a primary operating system of the computer.

Claims

1. A method for managing pestware comprising:

utilizing a primary operating system to effectuate operations of a computer;

running a secondary operating system simultaneously with the primary operating system;

utilizing the secondary operating system to identify indicia of pestware-related activity on the computer; and

managing the pestware-related activity.

2. The method of claim 1, wherein the operations of the computer effectuated with the primary operating system include operations visible to a user of the computer.

3. The method of claim 1 including:

informing, utilizing the primary operating system, a user about the pestware-related activity on the computer.

4. The method of claim 3 including:

storing information about the identified pestware-related activity on a storage media accessible by the primary operating system;

accessing the information utilizing the primary operating system; and

displaying at least a portion of the information for a user.

5. The method of claim 4, wherein the managing the pestware includes a user providing direction relative to management of the pestware based on the at least a portion of the information.

6. The method of claim 1, wherein the utilizing the secondary operating system to identify indicia of pestware activity on the computer includes running pestware identification code utilizing the secondary operating system.

7. The method of claim 6, wherein the pestware identification code includes code to scan both, an executable memory and a storage device of the computer.

8. The method of claim 7, wherein the pestware detection code includes code to circumvent the secondary operating system when scanning the executable memory and the storage device of the computer.

9. The method of claim 6, wherein the pestware identification code includes a driver in communication with the secondary operating system to identify indicia of pestware activity.

10. The method of claim 1, wherein the managing includes managing the pestware-related activity utilizing a management scheme selected from the group consisting of:

quarantining pestware;

removing the pestware and disabling the pestware.

11. The pestware management system of claim 10, wherein the second anti-pestware module is configured to communicate with the first anti-pestware module so as to enable the second anti-pestware module to provide information about the potential pestware activity to the first anti-pestware module.

12. The pestware management system of claim 10, wherein the second anti-pestware module includes a quarantine module configured to quarantine a file identified as a potential pestware file.

13. The pestware management system of claim 10, wherein the detection module of the second anti-pestware module is configured to scan an executable memory of the computer so as to identify indicia of pestware activity on the computer.

14. The pestware management system of claim 13, wherein the detection module is configured to scan the executable memory by selectively scanning portions of memory for indicia of pestware activity that are offset from reference points in the executable memory.

15. The pestware management system of claim 14, wherein the reference points include reference points selected from the group consisting of:

an API implementation and a start address of a process.

16. The pestware management system of claim 14, wherein the detection module is configured to scan executable op code at the portions of the memory for the indicia of pestware activity.

10-1. A pestware management system comprising:

a first anti-pestware module in communication with a primary operating system of a computer; and

a second anti-pestware module in communication with a secondary operating system of the computer, and wherein the second anti-pestware module includes a detection module configured to identify pestware activity that adversely affects operation of the first anti-pestware module.