SYSTEM AND METHOD FOR PROTECTING A REGISTRY OF A COMPUTER

• US 20080127352A1
• Filed: 08/18/2006
• Published: 05/29/2008
• Est. Priority Date: 08/18/2006
• Status: Abandoned Application

• Current Assignee: Webroot Software Incorporated (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Wang, Min
• Application Number:
  US11/465,688
• Publication Number:
  US 20080127352A1
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow

Abstract

A system and method for protecting a registry from pestware or malware is described. One embodiment includes receiving, at a filter, a registry access signal from an application. The registry access signal is rerouted, using the filter, to a virtual registry. The virtual registry corresponds to at least a portion of a registry of a computer that includes an entry related to an operating system (OS) of the computer.

Claims

1. A method, comprising:

receiving, at a filter, a registry access signal from an application; and

rerouting, using the filter, the registry access signal to a virtual registry, the virtual registry corresponds to at least a portion of a registry of a computer, the registry includes an entry related to an operating system (OS) of the computer.

2. The method of claim 1, further comprising routing the registry access signal to the filter.

3. The method of claim 1, further comprising authenticating the registry access signal using the filter.

4. The method of claim 3, wherein the authenticating includes identifying a process associated with the registry access signal and includes analyzing whether the process is a potential pestware process.

5. The method of claim 4, wherein the analyzing includes analyzing using at least one of a definition-based analysis, a heuristics-based analysis and an offset scanning analysis.

6. The method of claim 1, wherein the virtual registry includes a virtual registry entry that corresponds to a registry entry from the registry identified as a critical registry entry.

7. The method of claim 1, wherein the registry access signal is configured to trigger at least one of reading, deleting, or modifying a portion of the registry.

8. The method of claim 1, wherein the rerouting to the virtual registry includes rerouting to a location within the virtual registry that corresponds to a location within the registry.

9. The method of claim 1, wherein the rerouting to the virtual registry includes routing to a location within the virtual registry when a target location of the registry access signal is a location within the registry that corresponds with the location within the virtual registry.

10. The method of claim 1, wherein the virtual registry is a secure virtual registry.

11. The method of claim 1, wherein the registry access signal is an application program interface call.

12. A method, comprising:

accessing a portion of a registry identified as a critical portion;

generating a portion of a virtual registry that corresponds to the critical portion of the registry; and

controlling access to the virtual registry.

13. The method of claim 12, wherein the controlling includes controlling using a filter.

14. The method of claim 12, further comprising allocating a location in a memory for the portion of the virtual registry, the generating includes saving the portion of the virtual registry in the allocated memory location.

15. The method of claim 12, wherein the critical portion of the registry includes at least one of a registry entry that enables an operating system (OS) to load an application, a registry entry associated with an installation of an application, a registry entry associated exclusively with an OS, and a registry entry associated with a security application.

16. The method of claim 12, further comprising rerouting, using a filter, a registry access signal to the portion of the virtual registry,

the registry access signal being routed to the critical portion of the registry before the rerouting.

17. The method of claim 12, further comprising routing a registry access signal to a portion of the registry identified as a non-critical portion.

18. The method of claim 12, further comprising authenticating a registry access signal.

19. The method of claim 12, wherein the identifying includes identifying during a boot-up sequence.

20. The method of claim 12, wherein the generating includes generating during a boot-up sequence.

21. A method comprising:

accessing a portion of a registry of a computer, the registry includes an entry related to an operating system (OS) of the computer;

accessing a portion of a virtual registry corresponding with the portion of the registry; and

identifying a difference between the portion of the virtual registry and the portion of the registry.

22. The method of claim 21, sending a request to modify the registry based on the difference.

23. The method of claim 21, further comprising modifying the registry based on the difference.

24. The method of claim 21, wherein the difference is a result of at least one of an unauthorized modification to the registry by a pestware application or an authorized modification to the virtual registry by an application.