Back to results
US 8,943,595 B2Granted
Granular virus detection
AssigneeInternational Business Machines Corporation
InventorsSandro Piccinini, Luigi Pichetti, Marco Secchi, Stefano Sidoti
Life of this patent
Estimating the term…
Abstract
A group of files for an application installed on a computer system is identified in response to a request to scan the application for malware. The group of files for the application is scanned for the malware. A result is obtained. An action is performed based on the result.
Claims18
A method for managing malware comprising:
- identifying, by a computer system, a group of files for an application installed on the computer system in response to a request to scan the application for the malware;
- determining, by the computer system, whether the application installed on the computer system has a package in a catalog of a manager;
- responsive to the computer system determining that the application installed on the computer system does have the package in the catalog of the manager, determining, by the computer system, whether a block in the package contains a reference to a remote file that is retrieved at installation of the application;
- responsive to the computer system determining that the block contains the reference to the remote file that is retrieved at the installation of the application, uninstalling, by the computer system, the application installed on the computer system;
- generating, by the computer system, a first image of the group of files for the application not installed on the computer system;
- reinstalling, by the computer system, the application on the computer system;
- generating, by the computer system, a second image of the group of files for the application reinstalled on the computer system;
- comparing, by the computer system, the first image and the second image of the group of files for the application to form a comparison;
- determining, by the computer system, a number of differences between the first image and the second image of the group of files for the application based on the comparison;
- including, by the computer system, the number of differences between the first image and the second image of the group of files for the application in a second package that is valid only for the request to scan the application for the malware;
- parsing, by the computer system, a number of blocks in the second package;
- responsive to the computer system parsing the number of blocks in the second package, forming, by the computer system, a list of files for the application;
- selecting, by the computer system, a number of files from the list of files;
- generating, by the computer system, a descriptor identifying the number of files selected from the list of files;
- placing, by the computer system, a command to perform the scan for the malware in the descriptor identifying the number of files;
- sending, by the computer system, the descriptor with the command to perform the scan for the malware to a scanner;
- scanning, by the computer system, the number of files for the application for the malware using the scanner to obtain a report corresponding to the scan;
- modifying, by the computer system, a block format in the computer system by adding a number of new stanzas containing a map between a file name and an application module name;
- and
- responsive to the computer system identifying in the report a file in the number of files for the application as infected with the malware, downgrading, by the computer system, the application by removing only a specific module that uses the file infected with the malware from the application without impacting other functionalities of the application, wherein the application module name of the specific module is mapped to the file name of the file infected with the malware by a stanza in the number of new stanzas in the modified block format in the computer system.
17 more elements
An apparatus for managing malware comprising:
- a computer system;
- and
- program code stored on the computer system, wherein the computer system is configured by the program code to:
- identify a group of files for an application installed on the computer system in response to request to scan the application for malware;
- determine whether the application installed on the computer system has a package in a catalog of a manager;
- determine whether a block in the package contains a reference to a remote file that is retrieved at installation of the application in response to determining that the application installed on the computer system does have the package in the catalog of the manager;
- uninstall the application installed on the computer system in response to determining that the block contains the reference to the remote file that is retrieved at the installation of the application;
- generate a first image of the group of files for the application not installed on the computer system;
- reinstall the application on the computer system;
- generate a second image of the group of files for the application reinstalled on the computer system;
- compare the first image and the second image of the group of files for the application to form a comparison;
- determine a number of differences between the first image and the second image of the group of files for the application based on the comparison;
- include the number of differences between the first image and the second image of the group of files for the application in a second package that is valid only for the request to scan the application for the malware;
- parse a number of blocks in the second package;
- form a list of files for the application in response to parsing the number of blocks in the second package;
- select a number of files from the list of files;
- generate a descriptor identifying the number of files selected from the list of files;
- place a command to perform the scan for the malware in the descriptor identifying the number of files;
- send the descriptor with the command to perform the scan for the malware to a scanner;
- scan the number of files for the application for the malware using the scanner to obtain a report corresponding to the scan;
- modify a block format in the computer system by adding a number of new stanzas containing a map between a file name and an application module name;
- and
- downgrade the application by removing only a specific module that uses a file infected with the malware from the application without impacting other functionalities of the application in response to identifying in the report the file in the number of files for the application as infected with the malware, wherein the application module name of the specific module is mapped to the file name of the file infected with the malware by a stanza in the number of new stanzas in the modified block format in the computer system.
20 more elements
A computer program product for managing malware comprising:
- a non-transitory computer-readable storage medium having computer-readable program code embodied therewith that is executable by a computer system, the computer-readable program code comprising;
- computer-readable program code configured to identify a group of files for an application installed on the computer system in response to request to scan the application for malware;
- computer-readable program code configured to determine whether the application installed on the computer system has a package in a catalog of a manager;
- computer-readable program code configured to determine whether a block in the package contains a reference to a remote file that is retrieved at installation of the application in response to determining that the application installed on the computer system does have the package in the catalog of the manager;
- computer-readable program code configured to uninstall the application installed on the computer system in response to determining that the block contains the reference to the remote file that is retrieved at the installation of the application;
- computer-readable program code configured to generate a first image of the group of files for the application not installed on the computer system;
- computer-readable program code configured to reinstall the application on the computer system;
- computer-readable program code configured to generate a second image of the group of files for the application reinstalled on the computer system;
- computer-readable program code configured to compare the first image and the second image of the group of files for the application to form a comparison;
- computer-readable program code configured to determine a number of differences between the first image and the second image of the group of files for the application based on the comparison;
- computer-readable program code configured to include the number of differences between the first image and the second image of the group of files for the application in a second package that is valid only for the request to scan the application for the malware;
- computer-readable program code configured to parse a number of blocks in the second package;
- computer-readable program code configured to form a list of files for the application in response to parsing the number of blocks in the second package;
- computer-readable program code configured to select a number of files from the list of files;
- computer-readable program code configured to generate a descriptor identifying the number of files selected from the list of files;
- computer-readable program code configured to place a command to perform the scan for the malware in the descriptor identifying the number of files;
- computer-readable program code configured to send the descriptor with the command to perform the scan for the malware to a scanner;
- computer-readable program code configured to scan the number of files for the application for the malware using the scanner to obtain a report corresponding to the scan;
- computer-readable program code configured to modify a block format in the computer system by adding a number of new stanzas containing a map between a file name and an application module name;
- and
- computer-readable program code configured to downgrade the application by removing only a specific module that uses a file infected with the malware from the application without impacting other functionalities of the application in response to identifying in the report the file in the number of files for the application as infected with the malware, wherein the application module name of the specific module is mapped to the file name of the file infected with the malware by a stanza in the number of new stanzas in the modified block format in the computer system.
18 more elements
Dependencies are inferred from the claim text.