Malware automated removal system and method
AssigneeBby Solutions, Inc.
InventorsMichael Wenzinger, Michael Sherwood
Life of this patent
Estimating the term…
Abstract
The present invention automates the operation of multiple malware removal software products using a computerized system that systematically operates the multiple selected software products. These products are operated them in a customized “Safe Mode” using a shell that is different than the computer's other shell environments. Unlike the ordinary Safe Modes shells, the Custom Safe Mode prevents malware from functioning that ties itself to the normal shell, such as the Windows Explorer shell. In addition, the Custom Safe Mode allows the automation of tasks beyond that which is available under the standard command line shell.
Claims21
A computerized method for removing malware from a computer operating an operating system infected with the malware that provides a user interface with network services, the computerized method comprising:
- a) accessing non-volatile storage of the computer, the non-volatile storage containing the infected operating system including a normal shell of the infected operating system and a second shell of the infected operating system;
- b) initiating a malware removal process application while in the normal shell of the infected operating system, the malware removal process application causing the computer to automatically perform the following steps:
- i) downloading updates for a plurality of malware removal applications;
- ii) rebooting the computer into the second shell of the infected operating system;
- c) the second shell of the infected operating system automatically performing the following steps after reboot:
- i) for each of the malware removal applications, sequentially performing the following steps:
- (1) installing the malware removal application from a removable computer readable medium onto the non-volatile storage on the computer,
- (2) updating the malware removal applications using the updates previously downloaded,
- (3) running the malware removal application in the second shell, the malware removal application removing the malware infecting the infected operating system,
- (4) uninstalling the malware removal application from the non-volatile storage on the computer;
- and
- ii) rebooting the computer back into the normal shell of the previously infected operating system.
A computerized method for removing malware from an infected operating system located on a tangible, non-volatile storage of a computer system the infected operating system including a normal shell of the infected operating system and a second shell of the infected operating system;
- comprising:
- a) initiating a malware removal process application while in the normal shell of the infected operating system, the malware removal process application causing the computer system to automatically perform the following steps:
- i) downloading updates for a plurality of malware removal applications;
- ii) rebooting the computer into the second shell of the infected operating system;
- b) booting the computer system into the second shell of the infected operating system, the second shell having programming to automatically perform the following steps:
- i) for each of the plurality of malware removal software applications,
- (1) installing the malware removal software application onto non-volatile storage of the computer system and updating the malware removal applications using the updates previously downloaded,
- (2) running the malware removal software application, the malware removal application removing malware infecting the operating system, and
- (3) uninstalling the malware removal software application from the non-volatile storage.
A computer system comprising:
- a) a processor, random access memory, an input, a display, and non-volatile storage;
- b) a normal shell of an infected operating system existing as programming on the non-volatile storage, the normal shell having a user interface and a variety of drivers and services, the services including network and Internet services;
- c) a removable computer readable medium;
- d) a plurality of malware removal applications existing as programming on the removable computer readable medium;
- e) a malware removal update process operating on the processor causing the processor to download updates to the plurality of malware removal applications while the computer is operating using the normal shell of the infected operating system;
- f) a safe shell of the infected operating system existing as programming on the non-volatile storage, the safe shell not having network and Internet services, the safe shell having programming for:
- i) terminating a plurality of non-critical processes after starting the second shell;
- ii) for each of the plurality of malware removal software applications,
- (1) installing the malware removal software application from the removable computer readable medium onto the non-volatile storage of the computer system and updating the malware removal software applications using the updates previously downloaded,
- (2) running the malware removal software application, the malware removal application removing malware infecting the infected operating system, and
- (3) uninstalling the malware removal software application from the non-volatile storage of the computer system.
Dependencies are inferred from the claim text.