Kernel Driver Malware Removal System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cure-resistant malware poses a significant challenge as it intentionally evades removal by creating multiple copies of itself, using different threads and memory locations, making it difficult for antivirus software to completely eliminate, as one copy can re-infect the system even after another is deleted.
Innovation Solution
A system and method that involves identifying and blocking the activation of malicious program copies, deleting their executable files, and rebooting the computer, utilizing a driver loaded into the kernel space to prevent re-infection by disabling writes to persistent storage and system registry, and blocking new process launches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional antivirus methods delete one copy of the malicious program, then that copy is removed from memory and executable files are deleted, but the malware can re-infect the system by copying itself back from other active copies
Solution Approach 1:
The system performs preliminary actions by identifying all copies of the malicious program before deletion and blocking their ability to reactivate. The anti-virus program scans the system to detect multiple instances of the malware, then implements blocking mechanisms (such as disabling registry keys or system services) that prevent the malware from copying itself back into memory after one copy is deleted. This preliminary identification and blocking prevents the re-infection cycle from occurring.
2Reliability
If the anti-virus program deletes the malicious code from memory and executable files, then the detected copy is removed, but other copies detect the deletion and immediately re-infect the system
Solution Approach 1:
The system applies preliminary anti-action by implementing blocking mechanisms that counteract the malware's re-infection capability before it can execute. When the anti-virus program detects and begins to delete a malicious copy, blocking actions are simultaneously activated to prevent other copies from copying themselves back into memory. This may involve disabling specific registry keys, blocking system calls, or preventing the execution of re-infection routines, thereby neutralizing the malware's ability to recover even if deletion is not complete.
3Reliability
If the malware runs multiple copies simultaneously using different threads and memory locations, then it increases its survival capability, but it also increases the difficulty of detection and complete removal
Solution Approach 1:
The anti-virus program implements a universal detection mechanism that can identify multiple instances of the same malicious program across different locations and threads. The system uses a unified approach to scan memory spaces, executable files, and system registry for patterns characteristic of the malware family, regardless of where the copies are located or how they are structured. This multi-functional scanning capability allows the anti-virus to detect all copies simultaneously and apply the same blocking and deletion procedures to each instance.
Data Source
AI summary
A system, method and computer program product for treating a malware in a computer having multiple copies of the same malicious code activated, where the multiple copies monitor each other's existence, including (a) identifying a presence of the malicious code on the computer; (b) blocking actions that permit one active copy of the malicious code to activate another copy of the malicious code; (c) deleting, from persistent storage, a file containing executable code of the malware; and (d) rebooting the computer. The actions include disabling writes to the persistent storage, disabling writes to a system registry, and/or blocking activation of new processes. The blocking utilizes a driver loaded into the kernel space. The identifying can use signature identification for malware detection.