Utilizing early exclusive volume access and direct volume manipulation to remove protected files

A computer system comprising:

• a memory having stored therein a malicious code removal application;
• and
• a processor coupled to said memory, wherein execution of said malicious code removal application generates a method comprising:
• determining whether malicious code is detected on a host computer system;
• rebooting automatically the host computer system upon the determining finding that malicious code was detected on the host computer system;
• interrupting the rebooting process of the host computer system by a native application in the malicious code application;
• gaining access to a media comprising malicious code during said interrupted boot process;
• directly accessing said media during said interrupted boot process by bypassing a file system and operating system of the host computer system;
• and
• disabling said malicious code on the media during the directly accessing and during said interrupted boot process.

A computer-implemented method comprising:

• executing, on a processor, a malicious code removal application, the executing comprising:
• determining whether malicious code is detected on a host computer system;
• rebooting automatically the host computer system upon the determining finding that malicious code was detected on the host computer system;
• interrupting the rebooting process of the host computer system by a native application in the malicious code removal application;
• gaining access to a media comprising malicious code during said interrupted boot process;
• directly accessing said media during said interrupted boot process by bypassing a file system and operating system of the host computer system;
• and
• disabling said malicious code on the media during the directly accessing and during said interrupted boot process.