System and Method for Detection and Treatment of Malware on Data Storage Devices

• US 20130318610A1
• Filed: 05/22/2012
• Published: 11/28/2013
• Est. Priority Date: 05/22/2012
• Status: Active Grant

• Current Assignee: Kaspersky Lab ZAO
• Original Assignee: Kaspersky Lab ZAO
• Inventors: Zaitsev, Oleg V.
• Granted Patent: US 8,782,793 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Disclosed are systems and methods for detection and repair of malware on data storage devices. The system includes a controller, a communication interface for connecting an external data storage device, and a memory for storing antivirus software. The antivirus software is configured to scan the data contained in the data storage device, perform repair or removal of malicious files or programs found on the data storage device, identify suspicious files or programs on the data storage device and malicious files or programs that cannot be repaired or removed from the data storage device, send information about these files or programs to the antivirus software provider, receive updates for the antivirus software from the antivirus software provider, and rescan the suspicious files or programs and malicious files or programs that cannot be repaired or removed using updated antivirus software.

Claims

1. A computer-implemented method for detection and repair of malware on data storage devices, the method comprising:

connecting an external data storage device to a processing device;

scanning the data contained in the data storage device using antivirus software deployed on the processing device;

performing by the antivirus software repair or removal of one or more malicious files or programs found on the data storage device;

identifying one or more suspicious files or programs found on the data storage device and one or more malicious files or programs that cannot be repaired or removed from the data storage device by the antivirus software;

reporting the one or more suspicious files or programs and one or more malicious files or programs that cannot be repaired or removed to the user;

sending information about the suspicious files or programs and malicious files or programs that cannot be repaired or removed to the antivirus software provider;

receiving updates for the antivirus software from the antivirus software provider; and

rescanning at least the suspicious files or programs and malicious files or programs that cannot be repaired or removed by the updated antivirus software.

2. The method of claim 1, wherein connecting an external data storage device to a processing device further comprises at least:

backing up data from the data storage device to the processing device.

3. The method of claim 1, wherein connecting an external data storage device to a processing device further comprises at least:

identifying the connected data storage device, including identifying one or more of the name of the data storage device, the size of the memory of the data storage device, the type of the memory of the data storage device, and the manufacturer of data storage device.

4. The method of claim 1, wherein the processing device includes a memory and wherein backing up data stored on the data storage device, further comprises at least:

creating a dedicated partition or folder in the memory of the processing device; and

storing a backup copy of the data from the data storage device in the created partition or folder in the memory of the processing device.

5. The method of claim 4, wherein, if one or more file or programs are corrupted during the antivirus scanning of the data storage device, replacing the data in the data storage device with the backup copy of the data stored in the memory of the processing device.

6. The method of claim 1, wherein reporting the one or more suspicious files or programs and one or more malicious files or programs that cannot be repaired or removed to the user further comprises at least:

providing user-recommendations for dealing with the suspicious files or programs and with the malicious files or programs that cannot be repaired or removed.

7. The method of claim of 1, wherein updating antivirus software further comprises at least:

updating signatures of known clean and malicious programs; and

updating heuristic analysis algorithms.

8. A computer-based system for detection and repair of malware on data storage devices, the system comprising:

a communication interface for connecting an external data storage device;

a memory storing an antivirus software; and

a controller coupled to the communication interface and the memory, the processor being configured to;

scan the data contained in the data storage device using antivirus software deployed on the processing device;

perform by the antivirus software repair or removal of one or more malicious files or programs found on the data storage device;

identify one or more suspicious files or programs found on the data storage device and one or more files or programs that cannot be repaired or removed from the data storage device by the antivirus software;

report the one or more suspicious files or programs and one or more malicious files or programs that cannot be repaired or removed to the user;

send information about the suspicious files or programs and malicious files or programs that cannot be repaired or removed to the antivirus software provider;

receive updates for the antivirus software from the antivirus software provider; and

rescan at least the suspicious files or programs and malicious files or programs that cannot be repaired or removed by the updated antivirus software.

9. The system of claim 8, wherein to connect an external data storage device to a processing device, the controller being further configured to at least:

back up data from the data storage device to the system memory.

10. The system of claim 8, wherein the controller being further configured to at least:

identify the connected data storage device, including identify one or more of the name of the data storage device, the size of the memory of the data storage device, the type of the memory of the data storage device, and the manufacturer of data storage device.

11. The system of claim 8, wherein to back up data stored on the data storage device, the controller further configured to at least:

create a dedicated partition or folder in the memory; and

store a backup copy of the data from the data storage device in the created partition or folder in the memory.

12. The system of claim 11, wherein, if one or more file or programs are corrupted during the antivirus scanning of the data storage device, the controller further configured to at least:

replace the data in the data storage device with the backup copy of the data stored in the memory.

13. The system of claim 8, wherein to report the one or more suspicious files or programs and one or more malicious files or programs that cannot be repaired or removed to the user, the controller further configured to at least:

provide user-recommendations for dealing with the suspicious files or programs and with the malicious files or programs that cannot be repaired or removed.

14. The system of claim 8, wherein to update antivirus software, the controller further configured to at least:

update signatures of known clean and malicious programs; and

update heuristic analysis algorithms.

15. A computer program product embedded in a non-transitory computer-readable storage medium, the computer-readable storage medium comprising computer-executable instructions for detection and repair of malware on data storage devices, the medium comprising instructions for:

connecting an external data storage device to a processing device;

scanning the data contained in the data storage device using antivirus software deployed on the processing device;

performing by the antivirus software repair or removal of one or more malicious files or programs found on the data storage device;

identifying one or more suspicious files or programs found on the data storage device and one or more files and programs that cannot be repaired or removed from the data storage device by the antivirus software;

reporting the one or more suspicious files or programs and one or more malicious files or programs that cannot be repaired or removed to the user;

sending information about the suspicious files or programs and malicious files or programs that cannot be repaired or removed to the antivirus software provider;

receiving updates for the antivirus software from the antivirus software provider; and

rescanning at least the suspicious files or programs and malicious files or programs that cannot be repaired or removed by the updated antivirus software.

16. The product of claim 15, wherein instruction for connecting the data storage device further comprise instructions for at least:

identifying the connected data storage device, including identifying one or more of the name of the data storage device, the size of the memory of the data storage device, the type of the memory of the data storage device, and the manufacturer of data storage device.

17. The product of claim 15, wherein the processing device includes a memory and wherein instructions for backing up data stored on the data storage device, further comprise instructions for at least:

creating a dedicated partition or folder in the memory of the processing device; and

storing a backup copy of the data from the data storage device in the created partition or folder in the memory of the processing device.

18. The product of claim 17, wherein, if one or more file or programs are corrupted during the antivirus scanning of the data storage device, providing instructions for replacing the data in the data storage device with the backup copy of the data stored in the memory of the processing device.

19. The product of claim 15, wherein instructions for reporting the one or more suspicious files or programs and one or more malicious files or programs that cannot be repaired or removed to the user further comprise instructions for at least:

providing user-recommendations for dealing with the suspicious files or programs and with the malicious files or programs that cannot be repaired or removed.

20. The product of claim 15, wherein instructions for updating antivirus software further comprise instructions for at least:

updating signatures of known clean and malicious programs; and

updating heuristic analysis algorithms.