Systems and methods for repairing system files

• US 8,725,702 B1
• Filed: 03/15/2012
• Issued: 05/13/2014
• Est. Priority Date: 03/15/2012
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Kane, David, Raman, Nivedhitha, Subramanian, Sonia, Meng, Wilson
• Primary Examiner(s): Chen, Susan
• Application Number:
  US13/420,799
• Time in Patent Office: 789 Days
• Field of Search: 707/202, 707/639, 709/226, 714/38.1, 714/769, 714/6.24, 714/3, 701/33, 717/173, 726/26
• US Class Current: 707/691
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files

Abstract

A computer-implemented method for repairing system files may include 1) identifying a request to repair a corrupted system file in an operating system, 2) receiving file metadata describing the corrupted system file and system metadata describing the operating system, 3) identifying an uncorrupted version of the corrupted system file by i) identifying a series of matching tests for matching the corrupted system file with the uncorrupted version, the series of matching tests including at least one file metadata item from the file metadata and at least one system metadata item from the system metadata, and ii) applying the series of matching tests in a predetermined order to a database of uncorrupted system files until a matching test matches the corrupted system file with the uncorrupted version of the system file. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for repairing system files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying a request to repair a corrupted system file in an operating system;

receiving file metadata describing the corrupted system file and system metadata describing the operating system;

identifying an uncorrupted version of the corrupted system file by;

identifying a series of matching tests for matching the corrupted system file with the uncorrupted version, the series of matching tests comprising at least one file metadata item from the file metadata and at least one system metadata item from the system metadata;

applying the series of matching tests in a predetermined order to a database of uncorrupted system files until a matching test matches the corrupted system file with the uncorrupted version of the system file.

2. The computer-implemented method of claim 1, further comprising repairing the corrupted system file with the uncorrupted version of the system file, wherein the corrupted system file comprises a system file used by the operating system in execution of the operating system.

3. The computer-implemented method of claim 2, wherein repairing the corrupted system file with the uncorrupted version of the system file comprises:

identifying at least one difference between the corrupted system file and the uncorrupted system file;

replacing the difference in the corrupted system file with a corresponding portion of the uncorrupted system file.

4. The computer-implemented method of claim 1, wherein receiving the file metadata comprises:

receiving the corrupted system file;

parsing a portable executable header of the corrupted system file for the file metadata.

5. The computer-implemented method of claim 1, wherein the series of matching tests comprises a matching test comparing the corrupted system file and each prospective match within the database of uncorrupted system files by comparing at least:

a checksum of the corrupted system file and a checksum of the prospective match;

an operating system version of the operating system and an operating system version of the prospective match;

a file name of the corrupted system file and a file name of the prospective match.

6. The computer-implemented method of claim 1, wherein the series of matching tests comprises a matching test comparing the corrupted system file and each prospective match within the database of uncorrupted system files by comparing at least:

a file architecture of the corrupted system file and a file architecture of the prospective match;

a file name of the corrupted system file and a file name of the prospective match.

7. The computer-implemented method of claim 1, wherein the series of matching tests comprises a matching test comparing the corrupted system file and each prospective match within the database of uncorrupted system files by comparing at least:

a product name of the corrupted system file and a product name of the prospective match;

a product version of the corrupted system file and a product version of the prospective match;

a file architecture of the corrupted system file and a file architecture of the prospective match;

a file name of the corrupted system file and a file name of the prospective match.

8. The computer-implemented method of claim 1, wherein:

the corrupted system file comprises a file that is infected with malware;

the computer-implemented method further comprises using the series of matching tests to repair the corrupted system file by identifying a difference between the corrupted system file and the uncorrupted version and replacing the difference in the corrupted system file with a corresponding portion of the uncorrupted version.

9. A system for repairing system files, the system comprising:

an identification module programmed to identify a request to repair a corrupted system file in an operating system;

a receiving module programmed to receive file metadata describing the corrupted system file and system metadata describing the operating system;

a matching module programmed to identify an uncorrupted version of the corrupted system file by;

identifying a series of matching tests for matching the corrupted system file with the uncorrupted version, the series of matching tests comprising at least one file metadata item from the file metadata and at least one system metadata item from the system metadata;

applying the series of matching tests in a predetermined order to a database of uncorrupted system files until a matching test matches the corrupted system file with the uncorrupted version of the system file;

at least one hardware processor configured to execute the identification module, the receiving module, and the matching module.

10. The system of claim 9, further comprising a repair module programmed to repair the corrupted system file with the uncorrupted version of the system file, wherein the system file comprises a file that interfaces directly with a kernel of the operating system to contribute to operation of the operating system.

11. The system of claim 10, wherein the repair module is programmed to repair the corrupted system file with the uncorrupted version of the system file by:

identifying at least one difference between the corrupted system file and the uncorrupted system file;

replacing the difference in the corrupted system file with a corresponding portion of the uncorrupted system file.

12. The system of claim 9, wherein the receiving module is programmed to receive the file metadata by:

receiving the corrupted system file;

parsing a portable executable header of the corrupted system file for the file metadata.

13. The system of claim 9, wherein the series of matching tests comprises a matching test comparing the corrupted system file and each prospective match within the database of uncorrupted system files by comparing at least:

a checksum of the corrupted system file and a checksum of the prospective match;

an operating system version of the operating system and an operating system version of the prospective match;

a file name of the corrupted system file and a file name of the prospective match.

14. The system of claim 9, wherein the series of matching tests comprises a matching test comparing the corrupted system file and each prospective match within the database of uncorrupted system files by comparing at least:

a file architecture of the corrupted system file and a file architecture of the prospective match;

a file name of the corrupted system file and a file name of the prospective match.

15. The system of claim 9, wherein the series of matching tests comprises a matching test comparing the corrupted system file and each prospective match within the database of uncorrupted system files by comparing at least:

a product name of the corrupted system file and a product name of the prospective match;

a product version of the corrupted system file and a product version of the prospective match;

a file architecture of the corrupted system file and a file architecture of the prospective match;

a file name of the corrupted system file and a file name of the prospective match.

16. The system of claim 9, wherein the series of matching tests comprises a matching test comparing the corrupted system file and each prospective match within the database of uncorrupted system files by comparing at least:

an operating system version of the operating system and an operating system version of the prospective match;

a service pack of the operating system and a service pack of the operating system version of the prospective match;

a hotfix of the operating system and a hotfix of the operating system version of the prospective match;

an architecture of the operating system and an architecture of the operating system version of the prospective match;

a file name of the corrupted system file and a file name of the prospective match.

17. A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify a request to repair a corrupted system file in an operating system;

receive file metadata describing the corrupted system file and system metadata describing the operating system;

identify an uncorrupted version of the corrupted system file by;

identifying a series of matching tests for matching the corrupted system file with the uncorrupted version, the series of matching tests comprising at least one file metadata item from the file metadata and at least one system metadata item from the system metadata;

applying the series of matching tests in a predetermined order to a database of uncorrupted system files until a matching test matches the corrupted system file with the uncorrupted version of the system file.

18. The computer-readable-storage medium of claim 17, wherein the one or more computer-executable instructions further cause the computing device to repair the corrupted system file with the uncorrupted version of the system file.

19. The computer-readable-storage medium of claim 18, wherein the one or more computer-executable instructions cause the computing device to repair the corrupted system file with the uncorrupted version of the system file by causing the computing device to:

identify at least one difference between the corrupted system file and the uncorrupted system file;

replace the difference in the corrupted system file with a corresponding portion of the uncorrupted system file.

20. The computer-readable-storage medium of claim 17, wherein the one or more computer-executable instructions cause the computing device to receive the file metadata by causing the computing device to:

receive the corrupted system file;

parse a portable executable header of the corrupted system file for the file metadata.