# US 2013/0160124 A1 · Disinfection of a File System > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0160124 A1 - Document ID: US20130160124A1 - Status: Published application - Kind: A1 - Application number: 13/325,276 - Filed: 2011-12-14 - Published: 2013-06-20 - Earliest claimed: 2011-12-14 - Assignees: F-Secure Corporation - Inventors: Mika STÅHLBERG; Mikko Hyppönen; Kimmo Kasslin; Veli-Jussi Kesti; Kai Nyman; Timo Harmonen - Web page: https://patentgrep.com/patent/US20130160124A1 ## CPC - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/554: {involving event detection and direct action} - G06F 21/561: {Virus type analysis} - G06F 21/568: {eliminating virus, restoring damaged files} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for determining appropriate actions to remedy potential security lapses following infection of a device by malware. Following detection of infection of the device the device undergoes a cleaning operation. As part of the cleaning operation infected electronic files and any other associated files or objects are removed from the device. From timestamps associated with the infected files and associated files and objects, either directly or from another source such as an anti-virus trace program, the time of infection can be estimated. This allows the system to reference timestamps on the device to determine the source of the infection. Additionally, if the type of infection is identified timestamps on the device can be used to determine where there are particular areas of vulnerability due to user actions on the device. ## Claims ### Claim 1 A method comprising: at a device, scanning the file system to identify an infected electronic file; determining an estimated time when the file system was likely to have been infected; comparing the estimated time to timestamps of events on the device; determining events occurring on the device at the estimated time; and determining the source of the infection from events occurring on the device at the estimated time. ### Claim 2 (depends on 1) The method of claim 1 wherein the determining the estimated time comprises generating a list of time stamps associated with the infected electronic file. ### Claim 3 (depends on 2) The method of claim 2 further comprising filtering the list of timestamps by at least one of the following: removing timestamps placed in the future, timestamps for files which do not relate to access points for infection, timestamps for registry values which are not launchpoints, timestamps for registry values that do not disable security functionality. ### Claim 4 (depends on 2) The method of claim 2 further comprising: comparing a filtered timestamp list to timestamps of events on the device; determining a list of events having timestamps corresponding to a timestamp on the filtered timestamp list; and determining the estimated time and source of the infection from the list of events. ### Claim 5 (depends on 1) The method of claim 1 wherein the determining comprises querying a log of a tracing application running on the device. ### Claim 6 (depends on 1) The method of claim 1 wherein the timestamps of events on the device comprise one or more of the following: timestamps associated with a web browser log, timestamps associated with a web browser cache, timestamps associated with a firewall log, timestamps associated with a list of contacted IP addresses, timestamps associated with a list of file names. ### Claim 7 (depends on 1) The method of claim 1 further comprising analyzing the infected electronic file to determine the type of infection or the actions of the infection on the device. ### Claim 8 (depends on 7) The method of claim 7 wherein the analyzing the infected electronic file includes determining characteristics of the infected electronic file. ### Claim 9 (depends on 8) The method of claim 8 wherein the characteristics of the infected electronic file are banking strings, browser hooks, maintaining open ports, maintaining a connection to a control server, performing keylogging or file system activity. ### Claim 10 (depends on 7) The method of claim 7 further comprising determining appropriate action to be undertaken by the user from the type of infection. ### Claim 11 (depends on 1) The method of claim 1 further comprising determining relevant events on the device between the time of infection and the time of detection. ### Claim 12 (depends on 11) The method of claim 11 wherein the determining relevant events comprises analyzing a web browser log or file registry for events occurring between the estimated time of infection and the time of removal of the infected electronic file from the device. ### Claim 13 A method comprising: at a device, scanning the file system to identify an infected electronic file determining an estimated time when the file system was likely to have been infected; analyzing the infected electronic file to determine the type of infection; determining events relevant to the type of infection which have occurred on the device after the estimated time; and determining, from the determined events and type of infection, appropriate action to be undertaken by the user. ### Claim 14 (depends on 13) The method of claim 13 wherein the determining relevant events comprises the step of analyzing a web browser log or file registry for events occurring between the estimated time of infection and the time of removal of the infected electronic file from the device. ### Claim 15 A computing device, comprising: at least one processor; and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the device to perform at least the following: scan a file system in the memory to identify an infected electronic file; determine an estimated time when the file system was likely to have been infected; compare the estimated time to timestamps of events on the device; determine events occurring on the device at the estimated time; and determine the source of the infection from events occurring on the device at the estimated time. ### Claim 16 (depends on 15) The computing device of claim 15, wherein the device is further configured to generate and filter a list of time stamps associated with the infected electronic file by at least one of the following: removing timestamps placed in the future, timestamps for files which do not relate to access points for infection, timestamps for registry values which are not launchpoints, timestamps for registry values that do not disable security functionality. ### Claim 17 A computing device, comprising: at least one processor; and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the device to perform at least the following: scan a file system in the memory to identify an infected electronic file determine an estimated time when the file system was likely to have been infected; analyze the infected electronic file to determine the type of infection; determine events relevant to the type of infection which have occurred on the device after the estimated time; and determine, from the determined events and type of infection, appropriate action to be undertaken by the user. ### Claim 18 (depends on 17) The computing device of claim 17, wherein determining events relevant to the type of infection which have occurred on the device after the estimated time comprises analyzing timestamps of events on the device, the timestamps of events on the device comprise one or more of the following: timestamps associated with a web browser log, timestamps associated with a web browser cache, timestamps associated with a firewall log, timestamps associated with a list of contacted IP addresses, timestamps associated with a list of file names. ### Claim 19 (depends on 1) A computer program, comprising computer readable code which, when run on a computer device, causes the computer device to perform the method of claim 1. ### Claim 20 (depends on 15) A computer program, comprising computer readable code which, when run on a computer device, causes the computer device to perform the method of claim 15. ### Claim 21 A computer program product comprising a computer readable medium bearing a computer program code embodied therein for use with a computer, the computer program code comprising: code for scanning the file system to identify an infected electronic file; code for determining an estimated time when the file system was likely to have been infected; code for comparing the estimated time to timestamps of events on the device; code for determining events occurring on the device at the estimated time; and code for determining the source of the infection from events occurring on the device at the estimated time. ### Claim 22 A computer program product comprising a computer readable medium bearing a computer program code embodied therein for use with a computer, the computer program code comprising: code for scanning the file system to identify an infected electronic file code for determining an estimated time when the file system was likely to have been infected; code for analyzing the infected electronic file to determine the type of infection; code for determining events relevant to the type of infection which have occurred on the device after the estimated time; and code for determining, from the determined events and type of infection, appropriate action to be undertaken by the user.