Method and system for rendering harmless a locked pestware executable object

• US 8,079,032 B2
• Filed: 03/22/2006
• Issued: 12/13/2011
• Est. Priority Date: 03/22/2006
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Nichols, Tony
• Primary Examiner(s): An, Meng
• Assistant Examiner(s): WAI, ERIC CHARLES
• Application Number:
  US11/386,590
• Publication Number:
  US 20070226704A1
• Time in Patent Office: 2,092 Days
• Field of Search: 726/24, 718/100
• US Class Current: 718/100
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

A method and system for rendering harmless a locked pestware executable object is described. In one illustrative embodiment, a locked pestware executable object is detected on a storage device of a computer, the locked pestware executable object being inaccessible via the computer'"'"'s operating system; the locked pestware executable object is accessed through direct drive access; and data in the locked pestware executable object is modified in a manner that renders it harmless to the computer.

Claims

1. A method, comprising:

detecting a locked pestware executable object on a storage device of a computer, the locked pestware executable object being inaccessible via an operating system of the computer;

accessing the locked pestware executable object through direct drive access, the direct drive access bypassing standard file Application-Program-Interface (API) function calls of the operating system;

modifying data in the locked pestware executable object in a manner that renders it harmless to the computer, wherein modifying includes rendering the locked pestware executable object invalid, to the operating system, as an executable object, wherein rendering the locked pestware executable object invalid includes inverting the order of two initial bytes of a DOS header of the locked pestware executable object; and

deleting the locked pestware executable object from the storage device automatically, after data in the locked pestware executable object has been modified and the computer has been rebooted.

2. The method of claim 1, wherein modifying includes replacing an initial portion of the locked pestware executable object with program code that causes a process associated with the locked pestware executable object to cease execution upon being launched.

3. A system, comprising:

a computer comprising a processor unit and memory, the computer being configured to execute a plurality of software modules, including;

a detection module configured to detect a locked pestware executable object on a storage device of a computer, the locked pestware executable object being inaccessible via an operating system of the computer, the detection module being hosted by the computer;

a direct-access module configured to access the locked pestware executable object through direct drive access, the direct drive access bypassing standard file Application-Program-Interface (API) function calls of the operating system, the direct-access module being hosted by the computer; and

a neutralization module configured to modify data in the locked pestware executable object in a manner that renders the locked pestware executable object harmless to the computer, the neutralization module being hosted by the computer, wherein the neutralization module is configured to render the locked pestware executable object invalid, to the operating system, as an executable object including inverting the order of two initial bytes of a DOS header of the locked pestware executable object, the neutralization module being further configured to delete the locked pestware executable object from the storage device automatically, after the neutralization module has modified data in the locked pestware executable object and the computer has been rebooted.

4. The system of claim 3, wherein the neutralization module is configured to replace an initial portion of the locked pestware executable object with program code that causes a process associated with the locked pestware executable object to cease execution upon being launched.

5. A system, comprising:

A computer comprising a processor unit and memory;

means for detecting a locked pestware executable object on a storage device of a computer, the locked pestware executable object being inaccessible via an operating system of the computer;

means for direct drive access to access the locked pestware executable object;

means for modifying data in the locked pestware executable object in a manner that renders the locked pestware executable object harmless to the computer, wherein the means for modifying is configured to render the locked pestware executable object invalid, to the operating system, as an executable object including inverting the order of two initial bytes of a DOS header of the locked pestware executable object; and

means for deleting the locked pestware executable object from the storage device automatically, after the means for modifying has modified data in the locked pestware executable object and the computer has been rebooted.

6. The system of claim 5, wherein the means for modifying is configured to replace an initial portion of the locked pestware executable object with program code that causes a process associated with the locked pestware executable object to cease execution upon being launched.

7. A non-transitory computer-readable storage medium containing program instructions, comprising:

a first instruction segment configured to detect a locked pestware executable object on a storage medium of a computer, the locked pestware executable object being inaccessible via an operating system of the computer;

a second instruction segment configured to access the locked pestware executable object through direct drive access, the direct drive access bypassing standard file Application-Program-Interface (API) function calls of the operating system; and

a third instruction segment configured to modify data in the locked pestware executable object in a manner that renders the locked pestware executable object harmless to the computer, wherein the third instruction segment is configured to render the locked pestware executable object invalid, to the operating system, as an executable object including inverting the order of two initial bytes of a DOS header of the locked pestware executable object, the third instruction segment being further configured to delete the locked pestware executable object from the storage device automatically, after the third instruction segment has modified data in the locked pestware executable object and the computer had been rebooted.

8. The non-transitory computer-readable storage medium of claim 7, wherein the third instruction segment is configured to replace an initial portion of the locked pestware executable object with program code that causes a process associated with the locked pestware executable object to cease execution upon being launched.