Bypassing File Access Restrictions for Malware Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus software is ineffective in detecting malware that employs file access restrictions to avoid detection, leaving computers vulnerable to malware infections and resulting in significant costs for disinfection and repair.
Innovation Solution
A method and system that bypasses restrictive access attributes to allow antivirus software to scan files for malware by identifying error messages, using backup services, impersonating authorized users, and creating duplicate file handles to access encrypted or locked files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software uses traditional scanning methods, then it can detect known malware signatures, but it cannot detect malware that employs file access restrictions to avoid detection
Solution Approach 1:
The patent introduces an intermediary component that acts as a mediator between the antivirus scanning system and the restricted access file. This intermediary obtains authorized access to the file through legitimate means (such as using backup service credentials or creating duplicate file handles) and allows the antivirus software to scan the file contents without violating the original access restrictions. This resolves the contradiction by enabling detection capability while respecting the file access control mechanisms.
Solution Approach 2:
The patent segments the file access process into distinct operational modes: normal access for application execution and privileged access for antivirus scanning. By separating these functions and implementing different access paths (through backup services, impersonation, or duplicate handles), the system enables antivirus software to scan restricted files without affecting the file's access control integrity for legitimate applications.
2Object-affected harmful factors
If malware uses file locking mechanisms, then it prevents unauthorized access and execution, but it also prevents antivirus software from scanning the file
Solution Approach 1:
The patent implements preliminary action by obtaining authorized access credentials or establishing alternative access paths before the antivirus scanning process begins. The system prepares duplicate file handles or secures backup service access in advance, ensuring that scanning capability is established before the file's locked state prevents normal access attempts. This allows the antivirus software to scan the file without triggering access violations.
3Reliability
If antivirus software attempts to access restricted files, then it may detect malware, but it generates access violation errors that prevent scanning
Solution Approach 1:
The patent introduces an intermediary access layer that handles the complexity of restricted file access. This intermediary component manages the acquisition of proper credentials, establishment of duplicate file handles, or coordination with backup services, thereby shielding the antivirus scanning operation from access violation errors. The scanning process operates through this intermediary without directly encountering the file's restricted access state.
Data Source
AI summary
The present invention is directed toward a system, method, and computer-readable medium that scan a file for malware that maintains a restrictive access attribute that limits access to the file. In accordance with one aspect of the present invention, a method for performing a scan for malware is provided when antivirus software on a computer encounters a file with a restrictive access attribute that prevents the file from being scanned. More specifically, the method includes identifying the restrictive access attribute that limits access to the file; bypassing the restrictive access attribute to access data in the file; and using a scan engine to scan the data in the file for malware.