Method and system for detecting and removing hidden pestware files

• US 8,381,296 B2
• Filed: 07/18/2011
• Issued: 02/19/2013
• Est. Priority Date: 07/07/2006
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Inc. (Open Text Corporation)
• Inventors: Sprowls, Patrick
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US13/184,931
• Publication Number:
  US 20120005752A1
• Time in Patent Office: 582 Days
• Field of Search: 726 22- 25, 709223-224, 711/162, 713/188, 717/131, 717/138
• US Class Current: 726/23
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

A method and system for detecting and removing a hidden pestware file is described. One illustrative embodiment detects, using direct drive access, a file on a computer storage device; determines whether the file is also detectable by the operating system by attempting to access the file using a standard file Application-Program-Interface (API) function call of the operating system; identifies the file as a potential hidden pestware file, when the file is undetectable by the operating system; confirms through an automated pestware-signature scan of the potential hidden pestware file that the potential hidden pestware file is a hidden pestware file; and removes automatically, using direct drive access, the hidden pestware file from the storage device.

Claims

1. A method for scanning a storage device of a computer for hidden pestware files, the method comprising:

reading a data-bearing portion of the storage device, the reading being performed sequentially in sector order using direct drive access, the direct drive access substantially bypassing standard file Application-Program-Interface (API) function calls of an operating system of the computer;

identifying, through the reading, files on the storage device;

determining whether an identified file is detectable by the operating system by attempting to access the identified file using a standard file API function call of the operating system, the identified file being detectable by the operating system when the attempt to access the identified file using the standard file API function call is successful, the identified file being undetectable by the operating system when the attempt to access that identified file using the standard file API function call is unsuccessful;

in response to determining that the identified file is undetectable, flagging the identified file to the operating system as a potential hidden pestware file;

performing an automated pestware-signature scan of the identified file flagged as a potential hidden pestware file to determine whether that identified file is indeed a hidden pestware file; and

in response to determining that the identified file is a hidden pestware file, removing from the storage device automatically, using direct drive access, the identified file determined to be a hidden pestware file.

2. The method of claim 1, wherein a backup copy is made of the identified file determined to be a hidden pestware file before the identified file is automatically removed from its original location on the storage device, the identified file thereby being quarantined to enable automatic recovery of the identified file when removal of that identified file is in error.

3. The method of claim 1, wherein the standard file API function call of the operating system is GetFileAttributes.

4. The method of claim 1, wherein determining whether an identified file is detectable by the operating system is performed for each identified file on the storage device.