Full disk encryption anti-malware scan

A method performed by a computer device for leveraging a Full Disk Encryption (FDE) pre-boot environment to conduct anti-malware scans during startup, the method comprising:

• before loading with processor circuitry of the computer device an operating system stored in a storage memory of the computer device, scanning for malware with the processor circuitry a targeted memory of the computer device by:
• identifying indicators for objects stored in the targeted memory;
• for each of the identified indicators:
• before sending the identified indicator to a reputation service, searching in a cache for a matching identified indicator;
• when the matching identified indicator is not found in the cache:
• sending the identified indicator to the reputation service via a communication interface of the computer device;
• receiving via the communication interface feedback from the reputation service, wherein:
• the feedback includes a verdict;
• the verdict is associated with the identified indicator;
• the identified indicator is associated with the stored object, such that the verdict is associated with at least one of the stored objects;
• the verdict identifies the associated at least one of the stored objects as malicious, suspicious, or benign;
• and
• the storage memory is a non-transitory computer readable medium including:
• disk partitions comprising an EFI (Extensible Firmware Interface) system partition (ESP) and at least one other disk partition storing an operating system;
• and
• the cache configured to store previous scans of the targeted memory, wherein:
• each of the stored previous scans includes at least one previous indicator associated with at least one previous verdict received from the reputation service;
• each of the at least one previous verdict identifies the associated at least one previous indicator as malicious, suspicious, or benign;
• the operating system comprises operating system files including a registry;
• processing memory comprising a temporary non-transitory computer readable medium;
• the targeted memory includes at least one of the ESP, the at least one disk partition, the registry of the operating system files, or the processing memory;
• and
• when the matching indicator is found in the cache, applying the at least one verdict associated with the matching identified indicator to the identified indicator;
• and
• loading with the processor circuitry the stored operating system based on the received feedback.

A system for leveraging a Full Disk Encryption (FDE) pre-boot environment to conduct anti-malware scans during startup, the system comprising:

• a reputation service comprising computer hardware including a computer processor;
• a computer device comprising:
• a communication interface configured to communicate with the reputation service using a network configuration;
• processing memory comprising a temporary non-transitory computer readable medium;
• storage memory comprising a non-transitory computer readable medium including:
• disk partitions comprising an EFI (Extensible Firmware Interface) system partition (ESP) and at least one other disk partition storing an operating system, wherein the operating system comprises operating system files including a registry;
• and
• a cache configured to store previous scans of targeted memory, wherein:
• each of the stored previous scans includes at least one previous indicator associated with at least one previous verdict received from the reputation service;
• and
• the targeted memory includes at least one of the ESP, at least one of the disk partitions, the registry of the operating system files, or the processing memory;
• and
• processor circuitry configured to:
• before loading the stored operating system, scan the targeted memory for malware by:
• identifying indicators for objects stored in the targeted memory;
• and
• for each of the identified indicators:
• before sending the identified indicator to the reputation service, search in the cache for a matching identified indicator;
• when the matching identified indicator is not found in the cache:
• sending the identified indicator to the reputation service via the communication interface;
• when the matching indicator is found in the cache, apply to the identified indicator the verdict associated with the matching identified indicator;
• wherein the computer processor of the reputation service is configured to:
• receive the sent indicators;
• analyze the received indicators to determine feedback, wherein:
• the feedback includes at least one verdict;
• the at least one verdict is associated with at least one indicator of the sent indicators;
• each of the indicators is associated with at least one of the stored objects, such that the at least one verdict is associated with at least one of the stored objects;
• and
• the at least one verdict identifies the associated at least one of the stored objects as malicious, suspicious, or benign;
• and
• send the determined feedback to the computer device;
• wherein the processor circuitry of the computer device is further configured to:
• receive via the communication interface the sent feedback;
• and
• load the stored operating system based on the received feedback.