System, method and computer program product for accelerating malware/spyware scanning

• US 7,984,503 B2
• Filed: 12/13/2004
• Issued: 07/19/2011
• Est. Priority Date: 09/27/2004
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Edwards, Jonathan L.
• Primary Examiner(s): LAFORGIA, CHRISTIAN A
• Application Number:
  US11/010,786
• Publication Number:
  US 20060075502A1
• Time in Patent Office: 2,409 Days
• Field of Search: 726 22- 24, 713/188, 718/107
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A system, method and computer program product are provided for scanning files. A plurality of file names in a registry of a computer is identified. By this identification, files associated with the file names are scanned. Another system, method and computer program product are further provided. In particular, a change in a registry of a computer is first identified. Then, a scan is conditionally performed based on whether the change in the registry is identified.

Claims

1. A method for scanning files, comprising:

determining whether a scan is scheduled;

if it is determined that the scan is scheduled;

identifying a plurality of file names in a registry of a computer, utilizing a processor; and

scanning files associated with the file names, where the files with associated file names in the registry are scanned; and

identifying a change in the registry of the computer;

wherein duplicate file names are removed;

wherein the determining whether the scan is scheduled is performed in parallel with the identifying the change in the registry of the computer.

2. A method for scanning files, comprising:

determining whether a scan is scheduled;

if it is determined that the scan is scheduled;

identifying a plurality of file names in a registry of a computer, utilizing a processor; and

scanning files associated with the file names, where the files with associated file names in the registry are scanned; and

identifying a change in the registry of the computer;

wherein the files are scanned for spyware;

wherein the determining whether the scan is scheduled is performed in parallel with the identifying the change in the registry of the computer.

3. The method as recited in claim 2, wherein the spyware includes adware.

4. The method as recited in claim 2, wherein the spyware includes dialer software.

5. The method as recited in claim 2, wherein a first time required for the scanning is less than a second time required for scanning files stored on harddisks of the computer.

6. The method as recited in claim 2, wherein the registry includes a location on the computer for storing information including at least one of hardware that is attached to the computer, system options that have been selected, a configuration of memory of the computer, and application programs to be present when an operating system of the computer is started.

7. The method as recited in claim 2, wherein the method is utilized to counter terrorism by preventing infection of cyber-frameworks with malware initiated by terrorists.

8. The method as recited in claim 2, wherein the file names are identified utilizing a predetermined format associated therewith.

9. The method as recited in claim 8, wherein the format includes a path.

10. The method as recited in claim 9, wherein the path includes a drive letter.

11. The method as recited in claim 8, wherein the predetermined format includes the form:

<

drive letter>

<

colon>

<

backslash>

<

path>

<

name>

.

12. The method as recited in claim 8, wherein the predetermined format distinguishes the names from other alphanumeric data in the registry of the computer.

13. The method as recited in claim 2, wherein the files are scanned for malware.

14. A method, comprising:

identifying a change in a registry of a computer, utilizing a processor;

conditionally performing a scan based on whether the change in the registry is identified, where the conditional scan is performed in order to identify malware or spyware that caused the change; and

determining whether a scan is scheduled;

wherein the conditional scan includes scanning at least one file and scanning each of a plurality of files identified in the registry;

wherein the identifying the change in the registry of the computer is performed in parallel with the determining whether the scan is scheduled.

15. The method as recited in claim 14, wherein the conditional scan includes scanning for malware.

16. The method as recited in claim 14, wherein the conditional scan includes scanning for spyware.

17. The method as recited in claim 16, wherein the spyware includes adware.

18. The method as recited in claim 16, wherein the spyware includes dialer software.

19. The method as recited in claim 14, wherein a first time required for the conditional scan is less than a second time required for scanning files stored on harddisks of the computer.

20. The method as recited in claim 14, wherein the registry includes a location on the computer for storing information including at least one of hardware that is attached to the computer, system options that have been selected, a configuration of memory of the computer, and application programs to be present when an operating system of the computer is started.

21. The method as recited in claim 14, wherein the method is utilized to counter terrorism by preventing infection of cyber-frameworks with malware initiated by terrorists.

22. The method as recited in claim 14, wherein the change includes a change to any file name in the registry.

23. The method as recited in claim 14, wherein the registry is continuously monitored for identifying the change.

24. The method as recited in claim 14, wherein a scheduled scan is performed on a periodic basis.

25. The method as recited in claim 24, wherein the conditional scan is performed prior to the scheduled scan.

26. The method as recited in claim 24, wherein the conditional scan is performed in parallel with the scheduled scan.

27. The method as recited in claim 14, wherein the conditional scan includes scanning the registry.

28. The method as recited in claim 27, wherein the scanning of the registry includes scanning the registry for at least one predetermined key.

29. The method as recited in claim 28, wherein the at least one predetermined key is deleted upon detection thereof.

30. A method, comprising:

identifying a change in a registry of a computer, the change including a change to any file in the registry, utilizing a processor;

conditionally performing a scan based on whether the change in the registry is identified, where the conditional scan is performed in order to identify malware or spyware that caused the change; and

determining whether a scan is scheduled;

wherein the conditional scan includes scanning at least one file;

wherein the at least one file includes only files associated with a changed file name;

wherein the identifying the change in the registry of the computer is performed in parallel with the determining whether the scan is scheduled.

31. A method, comprising:

determining whether a scan is scheduled, utilizing a processor;

if it is determined that the scan is scheduled;

identifying a plurality of file names in a registry of a computer,

removing duplicate file names in the registry of the computer, and

scanning files associated with the file names for spyware and malware;

identifying a change in the registry of the computer; and

if the change in the registry is identified;

identifying the file names in the registry of the computer,

removing the duplicate file names in the registry of the computer,

scanning the files associated with the file names for the spyware and the malware,

scanning the registry for predetermined keys, and

removing the predetermined keys;

wherein the determining whether the scan is scheduled and the identifying the change in the registry of the computer are performed in parallel.