System and method for managing pestware affecting an operating system of a computer

• US 20070169198A1
• Filed: 01/18/2006
• Published: 07/19/2007
• Est. Priority Date: 01/18/2006
• Status: Abandoned Application

• Current Assignee: Webroot Software Incorporated (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Nichols, Tony, Madddaloni, Phil
• Application Number:
  US11/334,596
• Publication Number:
  US 20070169198A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

Systems and methods for detecting and managing pestware affecting a first operating system of a computer are described. In one variation, the computer is booted up utilizing a second operating system that is a different operating system than the first operating system. After booting the computer with the second operating system, a storage device of the computer is scanned for pestware while the first operating system is inactive, and any pestware found on the storage device is managed in one or more of a variety of techniques. In some variations, for example, any identified pestware is quarantined so as to prevent the identified pestware from being launched when the first operating system is active.

Claims

1. A method for managing pestware affecting a first operating system of a protected computer, comprising:

booting the protected computer utilizing a second operating system, the second operating system being a different operating system than the first operating system;

scanning, after booting the protected computer with the second operating system, a storage device of the protected computer for pestware while the first operating system is inactive; and

managing any pestware found on the storage device.

2. The method of claim 1, including:

identifying at least one network connection of the protected computer;

utilizing the at least one network connection to contact a memory source external to the protected computer; and

accessing pestware definitions from the memory source;

wherein the scanning includes scanning the storage device utilizing the updated pestware definitions.

3. The method of claim 1, wherein the managing includes quarantining the pestware found on the storage device so as to prevent the pestware from launching when the first operating system is active on the protected computer.

4. The method of claim 1, wherein the scanning includes scanning files utilized by the first operating system.

5. The method of claim 4, wherein the scanning includes scanning a registry and a host file utilized by the first operating system.

6. The method of claim 1, wherein the scanning includes scanning the storage device with a scanning application launched after booting the protected computer with the second operating system.

7. The method of claim 6, wherein the scanning application is stored with the second operating system on the same medium.

8. The method of claim 1, wherein the second operating system is an operating system with a substantially smaller footprint than the first operating system.

9. The method of claim 1, wherein the booting includes booting the second operating system from a removable media, wherein the removable media is selected from the group consisting of flash memory removable media, an optical disk and magnetic disk.

10. The method of claim 1, wherein the booting includes booting the second operating system from the storage device of the protected computer.

18. The computer readable medium of claim 10, wherein the computer readable medium includes the storage device of the protected computer.

11. A computer readable medium encoded with instructions to manage pestware affecting a first operating system of a protected computer, the instructions including:

operating system instructions for enabling access to a storage device of the protected computer, wherein the operating system instructions include different instructions than instructions utilized by the first operating system; and

scanning instructions for scanning a storage device of the protected computer for pestware while the first operating system is inactive.

12. The computer readable medium of claim 11, wherein the operating system instructions include instructions for identifying at least one network connection of the protected computer and enabling communications with a memory source external to the protected computer, and wherein the instructions for scanning include instructions for retrieving updated pestware definitions form the external memory source scanning the storage device utilizing the updated pestware definitions.

13. The computer readable medium of claim 11, wherein the instructions include instructions for quarantining the pestware found on the storage device so as to prevent the pestware from launching when the first operating system is active on the protected computer.

14. The computer readable medium of claim 11, wherein the scanning instructions include instructions for scanning files utilized by the first operating system.

15. The computer readable medium of claim 14, wherein the instructions for scanning include instructions for scanning a registry and a host file utilized by the first operating system.

16. The computer readable medium of claim 11, wherein the operating system instructions have a substantially smaller footprint than instructions utilized by the first operating system.

17. The computer readable medium of claim 11, wherein the computer readable medium includes a computer readable medium that is selected from the group consisting of flash memory removable media, an optical disk and magnetic disk.