# US 10,503,898 B2 · Method for defending against malware > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,898 B2 - Document ID: US10503898B2 - Status: Granted - Kind: B2 - Application number: 15/723,581 - Filed: 2017-10-03 - Published: 2019-04-04 - Granted: 2019-12-10 - Earliest claimed: 2017-10-03 - Assignees: Grand Mate Co., Ltd. - Applicants: Grand Mate Co., Ltd. - Inventors: Chung-Chin Huang; Chin-Ying Huang; Hsin-Ming Huang; Hsing-Hsiung Huang; Yen-Jen Yeh; Yung-She Lin - Web page: https://patentgrep.com/patent/US10503898B2 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/562: {Static detection} - G06F 21/568: {eliminating virus, restoring damaged files} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 2221/2127: Bluffing - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A malware for defending against a malware includes the following steps: create a bait file in a storage media of an electric appliance; check whether the bait file is changed; when the bait file is changed, shut down the electric appliance. Thus, when the bait file is changed, it is determined that the malware has begun to execute, and the electric appliance is shut down immediately, so as to avoid the other files in the storage medium from continuously being changed by the malware, facilitating the follow-up information rescue. ## Claims ### Claim 1 A method for defending against a malware, comprising: A. creating at least one bait file in a storage media of an electric appliance; and B. checking whether the at least one bait file is changed; when the at least one bait file is changed, shutting down the electric appliance; wherein the electric appliance is connected to a server; the method further comprises that connecting a portable device to the server and establishing a corresponding relation between the electric appliance and the portable device before step B; step B further comprises that sending a first message to the server, and the server sends a second message to the portable device in accordance with the first message and the corresponding relation before shutting down the electric appliance. ### Claim 2 (depends on 1) The method of claim 1, wherein step A further comprises creating a predetermined content in the at least one bait file; checking the at least one bait file in step B, when the at least one bait file does not comprise the predetermined content, the at least one bait file is determined being changed. ### Claim 3 (depends on 1) The method of claim 1, wherein, in step B, when the at least one bait file is checked that a file name of the at least one bait file does not exist in the storage media, the at least one bait file is determined being changed. ### Claim 4 (depends on 1) The method of claim 1, wherein the electric appliance and at least one another electric appliance are connected to a local area network; before shutting down the electric appliance, step B further comprises that sending a message to the at least one another electric appliance, when the at least one another electric appliance receives the message, the connection between the at least one another electric appliance and the local area network is terminated. ### Claim 5 (depends on 1) The method of claim 1, wherein, step A further comprises that creating a plurality of bait files in a plurality of data paths in the storage medium, respectively; checking whether the bait files in the data paths are changed in step B; when any of the bait files is changed, shutting down the electric appliance. ### Claim 6 (depends on 1) The method of claim 1, wherein, step A further comprises that checking the number of files of each of the data paths in the storage medium and creating the bait file in one of the data paths with the largest number of files. ### Claim 7 (depends on 1) The method of claim 1, after step B, the method further comprises that restarting the electric appliance after shutting down the electric appliance, and checking whether a removable storage medium has a malware removal program having a predetermined file name: if the removable storage medium has the malware removal program, executing the malware removal program; if the removable storage medium does not have the malware removal program, shutting down the electric appliance. ### Claim 8 A method for defending against a malware, comprising: A. creating at least one bait file in a storage media of an electric appliance; and B. checking whether the at least one bait file is changed; when the at least one bait file is changed, shutting down the electric appliance; wherein the electric appliance and at least one another electric appliance are connected to a local area network; before shutting down the electric appliance, step B further comprises that sending a message to the at least one another electric appliance, when the at least one another electric appliance receives the message, the connection between the at least one another electric appliance and the local area network is terminated. ### Claim 9 (depends on 8) The method of claim 8, wherein step A further comprises creating a predetermined content in the at least one bait file; checking the at least one bait file in step B, when the at least one bait file does not comprise the predetermined content, the at least one bait file is determined being changed. ### Claim 10 (depends on 8) The method of claim 8, wherein, in step B, when the at least one bait file is checked that a file name of the at least one bait file does not exist in the storage media, the at least one bait file is determined being changed. ### Claim 11 (depends on 8) The method of claim 8, wherein, step A further comprises that creating a plurality of bait files in a plurality of data paths in the storage medium, respectively; checking whether the bait files in the data paths are changed in step B; when any of the bait files is changed, shutting down the electric appliance. ### Claim 12 (depends on 8) The method of claim 8, wherein, step A further comprises that checking the number of files of each of the data paths in the storage medium and creating the bait file in one of the data paths with the largest number of files. ### Claim 13 A method for defending against a malware, comprising: A. creating at least one bait file in a storage media of an electric appliance; and B. checking whether the at least one bait file is changed; when the at least one bait file is changed, shutting down the electric appliance; wherein after step B, the method further comprises that restarting the electric appliance after shutting down the electric appliance, and checking whether a removable storage medium has a malware removal program having a predetermined file name: if the removable storage medium has the malware removal program, executing the malware removal program; if the removable storage medium does not have the malware removal program, shutting down the electric appliance. ### Claim 14 (depends on 13) The method of claim 13, wherein step A further comprises creating a predetermined content in the at least one bait file; checking the at least one bait file in step B, when the at least one bait file does not comprise the predetermined content, the at least one bait file is determined being changed. ### Claim 15 (depends on 13) The method of claim 13, wherein, in step B, when the at least one bait file is checked that a file name of the at least one bait file does not exist in the storage media, the at least one bait file is determined being changed. ### Claim 16 (depends on 13) The method of claim 13, wherein, step A further comprises that creating a plurality of bait files in a plurality of data paths in the storage medium, respectively; checking whether the bait files in the data paths are changed in step B; when any of the bait files is changed, shutting down the electric appliance. ### Claim 17 (depends on 13) The method of claim 13, wherein, step A further comprises that checking the number of files of each of the data paths in the storage medium and creating the bait file in one of the data paths with the largest number of files.