System and method for analyzing locked files

• US 20060277182A1
• Filed: 06/06/2005
• Published: 12/07/2006
• Est. Priority Date: 06/06/2005
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Inc. (Open Text Corporation)
• Inventors: Burtscher, Michael, Nichols, Tony
• Granted Patent: US 8,452,744 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files

Abstract

Systems and methods for scanning files for pestware on a protected computer are described. In one variation, when a file on a storage device is inaccessible via an operating system of the protected computer, a listing of a plurality of pointers for the file is located on the storage device. Each of the plurality of pointers in the listing points to a corresponding one of a plurality of locations on the storage device, and the storage device stores each of a plurality of portions of data for the file at a corresponding one of each of the plurality of locations. One or more of the plurality of portions for the data are accessed and analyzed, while the operating system continues to limit access to the file via the operating system, so as to determine whether the file is a pestware file.

Claims

1. A method for scanning files located on a storage device of a protected computer for pestware, the method comprising:

identifying a file on the storage device that is inaccessible via an operating system of the protected computer;

locating, on the storage device, a listing of a plurality of pointers for the file, wherein each of the plurality of pointers in the listing points to a corresponding one of a plurality of locations on the storage device, and the storage device stores each of a plurality of portions of data for the file at a corresponding one of each of the plurality of locations;

accessing, while the operating system continues to limit access to the file via the operating system, at least one of the plurality of portions for the data; and

analyzing information from the at least one of the plurality of portions of data so as to determine whether the file is a potential pestware file.

2. The method of claim 1, including copying the at least one of the plurality of portions of data to a second file on the storage device, and wherein the analyzing information includes analyzing information from the second file.

3. The method of claim 1, wherein the analyzing includes placing the information in volatile memory and analyzing the information from the volatile memory.

4. The method of claim 1, wherein the listing of the plurality of pointers is located in a data bitmap, and wherein files on the storage device are organized in accordance with an NTFS system.

5. The method of claim 1, wherein the listing of the plurality of pointers are FAT entries in a FAT table.

6. The method of claim 1, wherein the locating includes locating a directory entry for the file.

7. The method of claim 1, including:

altering, in response to the file being identified as a pestware file and while the operating system continues to limit access to the file via the operating system, the listing of a plurality of pointers.

8. A system for detecting pestware files on a file storage device of a protected computer, the protected computer including an operating system, the system comprising:

a pestware detection module configured to;

identify a file on the storage device that is inaccessible via an operating system of the protected computer;

locate, on the storage device, a listing of a plurality of pointers for the file, wherein each of the plurality of pointers in the listing points to a corresponding one of a plurality of locations on the storage device, and the storage device stores each of a plurality of portions of data for the file at a corresponding one of each of the plurality of locations;

accessing, while the operating system continues to limit access to the file via the operating system, at least one of the plurality of portions for the data; and

analyzing information from the at least one of the plurality of portions of data so as to determine whether the file is a potential pestware file.

9. The system of claim 8, wherein the pestware detection module is configured to copy the at least one of the plurality of portions of data to a second file on the storage device, and wherein the analyzing information includes analyzing information from the second file.

10. The system of claim 8, wherein the pestware detection module is configured to place the information in volatile memory and analyze the information from the volatile memory.

11. The system of claim 8, wherein the listing of the plurality of pointers is located in a data bitmap, and wherein files on the storage device are organized in accordance with an NTFS system.

12. The system of claim 8, wherein the listing of the plurality of pointers are FAT entries in a FAT table.

13. The system of claim 8, wherein the pestware detection module is configured to locate a directory entry for the file.

14. The system of claim 8, including:

A pestware removal module configured to alter, in response to the file being identified as a pestware file and while the operating system continues to limit access to the file via the operating system, the listing of a plurality of pointers.

15. A computer readable medium encoded with instructions for scanning pestware files from a storage device of a protected computer, the instructions including instructions for:

identifying a file on the storage device that is inaccessible via an operating system of the protected computer;

locating, on the storage device, a listing of a plurality of pointers for the file, wherein each of the plurality of pointers in the listing points to a corresponding one of a plurality of locations on the storage device, and the storage device stores each of a plurality of portions of data for the file at a corresponding one of each of the plurality of locations;

accessing, while the operating system continues to limit access to the file via the operating system, at least one of the plurality of portions for the data; and

analyzing information from the at least one of the plurality of portions of data so as to determine whether the file is a potential pestware file.

16. The computer readable medium of claim 15, including instructions for copying the at least one of the plurality of portions of data to a second file on the storage device, and wherein the analyzing information includes analyzing information from the second file.

17. The computer readable medium of claim 15, wherein the instructions for analyzing include instructions for placing the information in volatile memory and analyzing the information from the volatile memory.

18. The computer readable medium of claim 15, wherein the listing of the plurality of pointers is located in a data bitmap, and wherein files on the storage device are organized in accordance with an NTFS system.

19. The computer readable medium of claim 15, including instructions for wherein the listing of the plurality of pointers are FAT entries in a FAT table.

20. The computer readable medium of claim 15, wherein the instructions for locating include instructions for locating a directory entry for the file.

21. The computer readable medium of claim 15, including instructions for:

altering, in response to the file being identified as a pestware file and while the operating system continues to limit access to the file via the operating system, the listing of a plurality of pointers.