Disinfection of a File System

A method comprising:

• at a device, scanning the file system to identify an infected electronic file
• determining an estimated time when the file system was likely to have been infected;
• analyzing the infected electronic file to determine the type of infection;
• determining events relevant to the type of infection which have occurred on the device after the estimated time;
• and
• determining, from the determined events and type of infection, appropriate action to be undertaken by the user.

A computing device, comprising:

• at least one processor;
• and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the device to perform at least the following:
• scan a file system in the memory to identify an infected electronic file;
• determine an estimated time when the file system was likely to have been infected;
• compare the estimated time to timestamps of events on the device;
• determine events occurring on the device at the estimated time;
• and
• determine the source of the infection from events occurring on the device at the estimated time.

A computing device, comprising:

• at least one processor;
• and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the device to perform at least the following:
• scan a file system in the memory to identify an infected electronic file
• determine an estimated time when the file system was likely to have been infected;
• analyze the infected electronic file to determine the type of infection;
• determine events relevant to the type of infection which have occurred on the device after the estimated time;
• and
• determine, from the determined events and type of infection, appropriate action to be undertaken by the user.

A computer program product comprising a computer readable medium bearing a computer program code embodied therein for use with a computer, the computer program code comprising:

• code for scanning the file system to identify an infected electronic file;
• code for determining an estimated time when the file system was likely to have been infected;
• code for comparing the estimated time to timestamps of events on the device;
• code for determining events occurring on the device at the estimated time;
• and
• code for determining the source of the infection from events occurring on the device at the estimated time.

A computer program product comprising a computer readable medium bearing a computer program code embodied therein for use with a computer, the computer program code comprising:

• code for scanning the file system to identify an infected electronic file
• code for determining an estimated time when the file system was likely to have been infected;
• code for analyzing the infected electronic file to determine the type of infection;
• code for determining events relevant to the type of infection which have occurred on the device after the estimated time;
• and
• code for determining, from the determined events and type of infection, appropriate action to be undertaken by the user.