System and method for suspending a computing device suspected of being infected by a malicious code using a kill switch button

A method for suspending a computing device suspected of being infected by a malicious code, comprising:

• receiving, from a user, a triggering signal to initiate a suspension procedure, wherein:
• the suspension procedure is initiated when a computing device is suspected of being infected by a malicious code, and
• when the malicious code is executed, the computing device becomes vulnerable to security threats comprising an unauthorized access to a memory associated with the computing device;
• capturing one or more states of one or more instructions that are being executed by a processor associated with the computing device, wherein the one or more instructions comprise the malicious code;
• storing the captured one or more states;
• suppressing the one or more instructions comprising the malicious code;
• sending one or more notification signals to one or more servers managing a user account associated with the user currently logged in at the computing device, indicating that the computing device is suspected of having been infected by the malicious code;
• in response to sending the one or more notification signals to the one or more servers, the user account is suspended;
• terminating network connections of the computing device such that the computing device is disconnected from other devices;
• erasing a particular portion of the memory in which boot up instructions are stored without which the computing device cannot be restarted, wherein the particular portion includes an address to a boot cycle operation;
• determining a source of the malicious code from the stored captured one or more states;
• and
• initiating security threat investigations using the determined source of the malicious code.

A non-transitory computer-readable medium storing instructions that when executed by a processor cause the processor to:

• receive, from a user, a triggering signal to initiate a suspension procedure, wherein:
• the suspension procedure is initiated when a computing device is suspected of being infected by a malicious code, and
• when the malicious code is executed, the computing device becomes vulnerable to security threats comprising an unauthorized access to a memory associated with the computing device;
• capture one or more states of one or more instructions that are being executed by a processor associated with the computing device, wherein the one or more instructions comprise the malicious code;
• store the captured one or more states;
• suppress the one or more instructions comprising the malicious code;
• send one or more notification signals to one or more servers managing a user account associated with the user currently logged in at the computing device, indicating that the computing device is suspected of having been infected by the malicious code;
• in response to sending the one or more notification signals to the one or more servers, the user account is suspended;
• terminate network connections of the computing device such that the computing device is disconnected from other devices;
• erase a particular portion of the memory in which boot up instructions are stored without which the computing device cannot be restarted, wherein the particular portion includes an address to a boot cycle operation;
• determine a source of the malicious code from the stored captured one or more states;
• and
• initiate security threat investigations using the determined source of the malicious code.