System and method for removal of malicious software from computer systems and management of treatment side-effects

A method for removing malware from a remote computer system having computing hardware, an operating system, and application programs executable on the computing hardware, the method comprising:

• obtaining, from an inspection module having access to the remote computer system, an inspection log representing operational history of the operating system and the application programs, the inspection log being produced as a result of monitoring of the operating system and application programs for a presence of malware;
• analyzing the inspection log to detect a presence of any malware on the computer system based on information contained in the inspection log and in accordance with a malware knowledge base containing indicia of known malware or non-malware programs;
• generating a treatment scenario that contains a specific set of instructions that represent a sequence of actions to be executed for removing any malware present on the computer system, as detected in the analyzing, wherein the treatment scenario is generated based on the information contained in the inspection log and on a knowledge base of malware removal rules;
• evaluating the generated treatment scenario based on a knowledge base of side-effects relating to malware treatment actions and on the information contained in the inspection log, such that the actions represented by the instructions of the generated treatment scenario that are associated with a risk of damaging the operating system or the application programs of the computer system are assessed;
• in response to an assessment of the risk, creating a modified treatment scenario to reduce the risk;
• and
• providing the modified treatment scenario for execution by a treatment scenario execution module operating on the remote computer system.

A system for removing malware from a computer system having computing hardware, an operating system, and application programs executable on the computing hardware, the system comprising:

• means for obtaining, from an inspection module having access to the computer system, an inspection log representing operational history of the operating system and the application programs, the inspection log being produced as a result of monitoring of the operating system and application programs for a presence of malware;
• means for analyzing the inspection log to detect a presence of any malware on the computer system based on information contained in the inspection log and in accordance with a malware knowledge base containing indicia of known malware or non-malware programs;
• means for generating a treatment scenario that contains a specific set of instructions that represent a sequence of actions to be executed for removing any malware present on the computer system, as detected in the analyzing, wherein the treatment scenario is generated based on the information contained in the inspection log and on a knowledge base of malware removal rules;
• means for evaluating the generated treatment scenario based on a knowledge base of side-effects relating to malware treatment actions and on the information contained in the inspection log, such that the actions represented by the instructions of the generated treatment scenario that are associated with a risk of damaging the operating system or the application programs of the computer system are assessed;
• means for creating a modified treatment scenario to reduce the risk in response to an assessment of the risk;
• and
• means for providing the modified treatment scenario for execution by a treatment scenario execution module operating for the benefit of the computer system.