Antivirus Driver Boot Priority for Malware Removal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in guaranteeing the removal of malicious code from computers, particularly due to the ability of advanced malware to prevent treatment by creating multiple copies and using rootkit technologies to hide from antivirus drivers, and the need to load appropriate drivers during the boot procedure to remove malicious objects.
Innovation Solution
The implementation of an antivirus driver system that performs a scan, formulates tasks for treatment, configures and activates the antivirus driver, and reboots the computer to execute these tasks upon boot, ensuring the driver is loaded early in the boot process to execute treatment actions such as deleting or quarantining malicious files and registry entries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the antivirus driver loads during the normal boot procedure, then the system can access all files and registry entries, but rootkit drivers may have already loaded and hidden malicious objects before the antivirus driver can detect and remove them
Solution Approach 1:
The patent applies preliminary action by loading the antivirus driver before other system drivers during the boot procedure. The antivirus driver is configured to execute treatment tasks (deletion, quarantine, restoration) of malicious objects before rootkit drivers can load and hide them. This timing ensures the antivirus driver has priority access to detect and remove malicious files and registry entries before they can be concealed by rootkit technologies.
2Loss of time
If the antivirus driver executes treatment tasks immediately upon detection, then the response time is reduced, but the driver may not have sufficient privileges or access to remove certain malicious objects
Solution Approach 1:
The patent formulates treatment tasks in advance during the boot procedure before the malicious objects are fully activated. The antivirus driver is configured with pre-planned treatment actions (deletion, quarantine, restoration) that will execute automatically when the boot process reaches the appropriate stage, ensuring both rapid response and sufficient system access for effective treatment.
Solution Approach 2:
The patent introduces a mediator mechanism where the antivirus driver acts as an intermediary between the detection of malicious objects and their removal. The driver receives detection information, formulates appropriate treatment tasks, and executes them through controlled boot-time operations, ensuring that treatment actions are both timely and effective by coordinating with the system boot process.
3Reliability
If the system loads all necessary drivers during boot to remove malicious objects, then complete treatment is possible, but the boot time increases and the antivirus driver may not execute treatment before rootkit drivers hide malicious files
Solution Approach 1:
The patent applies preliminary action by pre-formulating and pre-configuring the antivirus driver with treatment tasks before the boot process completes. The driver is activated during the early boot stage, before rootkit drivers can load and hide malicious objects. This ensures treatment actions are prepared and ready to execute immediately upon detection, without waiting for complete driver loading, thus reducing boot time while maintaining treatment completeness.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are systems, methods and computer program products for treatment of malware using an antivirus driver. An example method includes performing, by an antivirus software, an antivirus scan of the computer; detecting, by the antivirus software, a malicious object on the computer; formulating at least one task for treatment of the detected malicious object; configuring and activating on the computer an antivirus driver of the antivirus software to execute the at least one formulated task for treatment of the detected malicious object; and rebooting the computer by the antivirus software, whereby upon rebooting of the computer the antivirus driver is loaded by the operating system of the computer to execute the at least one task for treatment of the detected malicious object.