Malware management through kernel detection during a boot sequence
AssigneeWebroot Inc.
InventorJerome L. Schneider
Life of this patent
Estimating the term…
Abstract
A system and method for managing pestware on a protected computer is described. The method in one variation includes monitoring events during a boot sequence of the computer; managing pestware-related events before native applications can run and after a kernel is loaded; managing pestware-related events when native applications can run; and scanning a registry of the computer for pestware when native applications can run. In variations, a pestware management engine is initialized after an operating system of the protected computer is initialized and the pestware management system both receives an event log of the monitored events and compiles the set of behavior rules utilized by kernel-level monitor.
Claims18
A method for managing pestware on a computer comprising:
- monitoring events during a boot sequence of the computer;
- managing pestware-related events during a first period in a boot sequence of the computer, the first period in the hoot sequence occurring before the computer becomes configured to run native applications, before a subsystem of an operating system is loaded, and after a kernel is loaded;
- managing pestware-related events in accordance with a set of behavior rules during a second period in the boot sequence occurring when the computer is configured to run native applications;
- and
- scanning a registry of the computer for pestware during the second period in the boot sequence.
A system for managing pestware on a computer comprising:
- a processor;
- a memory comprising:
- a first instruction set configured to monitor events during a boot sequence of the computer;
- a second instruction set configured to manage pestware-related events during first period in a boot sequence of the computer, the first period in the boot sequence occurring before the computer becomes configured to run native applications, before a Win32 subsystem is loaded, and after a kernel is loaded;
- a third instruction set configured to manage pestware-related events in accordance with a set of behavior rules during a second period in the boot sequence occurring when the computer is configured to run native applications;
- and
- a fourth instruction set configured to scan a registry of the computer for pestware during the second period in the boot sequence.
A non-transitory tangible computer-readable storage medium comprising program instructions for:
- monitoring events during a boot sequence of the computer;
- managing pestware-related events during a first period in a boot sequence of the computer, the first period in the boot sequence occurring before the computer becomes configured to run native applications, before a Win32 subsystem is loaded, and after a kernel is loaded;
- managing pestware-related events in accordance with a set of behavior rules during a second period in the boot sequence occurring when the computer is configured to run native applications;
- and
- scanning a registry of the computer for pestware during the second period in the boot sequence.
Dependencies are inferred from the claim text.