System and method for detection and on-demand disinfection of remote devices

A computer-implemented method of performing detection and on-demand disinfection of remote devices by a VM controller executed by one or more processors, the computer-implemented method comprising:

• receiving, through a computing device, an executable file sample;
• extracting, through a communication device, the executable file sample from the computing device;
• evaluating, through the communication device, if the executable file sample received has been analyzed before;
• analyzing, through the communication device, the executable file sample;
• running, through the VM controller, a virtual machine to check status of the executable file sample;
• activating, through the VM controller, a driver register for enabling a file monitor to monitor a series of events occurring on the virtual machine, due to the running of the virtual machine;
• generating, through a file sample analysis generator, a file sample analysis report based on the series of events;
• and
• upon generation of the file sample analysis report, classifying, through an event classifier, the executable file sample based on the series of events and the file sample analysis report,
• wherein if the executable file sample is classified as malicious in nature, activating a scanner to scan the computing device or the remote devices over a remote internal network based on the file sample analysis report, to detect signs of infection in the computing device or the remote devices due to the executable file sample, and further check on conditions related with the computing device or the remote devices, wherein the action of the further check on the conditions related with the computing device or the remote devices comprises checking, by the scanner, if the computing device or the remote devices have registry modifications, or if the computing device or the remote devices have the executable file sample in their respective file subsystems.

A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to enable the VM controller to perform operations which are executed by the one or more processors, the operations comprising:

• receiving, through a computing device, an executable file sample;
• extracting, through a communication device, the executable file sample from the computing device;
• evaluating, through the communication device, if the executable file sample received has been analyzed before;
• analyzing, through the communication device, the executable file sample;
• running, through the VM controller, a virtual machine to check status of the executable file sample;
• activating, through the VM controller, a driver register for enabling a file monitor to monitor a series of events occurring on the virtual machine, due to the running of the virtual machine;
• generating, through a file sample analysis generator, a file sample analysis report based on the series of events;
• and
• upon generation of the file sample analysis report, classifying, through an event classifier, the executable file sample based on the series of events and the file sample analysis report,
• wherein if the executable file sample is classified as malicious in nature, activating a scanner to scan the computing device or the remote devices over a remote internal network based on the file sample analysis report, to detect signs of infection in the computing device or the remote devices due to the executable file sample, and further check on conditions related with the computing device or the remote devices, wherein the action of the further check on the conditions related with the computing device or the remote devices comprises checking, by the scanner, if the computing device or the remote devices have registry modifications, or if the computing device or the remote devices have the executable file sample in their respective file subsystems.