Neutralizing Locked Pestware via Direct Drive Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-pestware software is unable to effectively neutralize or delete locked pestware executable objects, which are inaccessible via the operating system and can prevent termination and conceal themselves using exclusive-lock flags and rootkits.
Innovation Solution
A method and system that detects locked pestware executable objects using direct drive access, bypassing standard file API function calls, and modifies their data to render them harmless, either by replacing initial code with termination code or rendering them invalid as executable objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard file API function calls are used to access pestware executable objects, then the operating system can manage files through standard interfaces, but locked pestware executable objects become inaccessible and cannot be neutralized or deleted
Solution Approach 1:
The patent uses direct drive access as an intermediary mechanism that bypasses the operating system's standard file API layer. This intermediary approach allows the anti-pestware software to access locked executable objects directly at the drive level, circumventing the exclusive-lock flags that block standard OS access while maintaining system stability through controlled direct access operations
2Strength
If exclusive-lock flags are used to protect executable objects, then file integrity is maintained, but anti-pestware software cannot access or terminate the pestware process
Solution Approach 1:
The patent inverts the access control approach by using direct drive access that operates opposite to the standard OS file access model. Instead of trying to overcome the exclusive-lock flags through normal OS interfaces, the system accesses the drive directly at a lower level where the lock flags do not apply, effectively turning the protection mechanism against the pestware by bypassing it entirely
3Object-generated harmful factors
If rootkits are used to conceal pestware, then the pestware remains hidden from file-system directory and task manager, but detection and neutralization become impossible through standard interfaces
Solution Approach 1:
The patent transitions from the file-system dimension where rootkits operate to the direct drive access dimension. By moving to direct drive access, the system accesses the executable objects in a different operational dimension that is not affected by rootkit concealment techniques. This dimensional shift allows detection and neutralization of pestware that is hidden from standard file-system views including directory listings and task manager displays
Data Source
AI summary
A method and system for rendering harmless a locked pestware executable object is described. In one illustrative embodiment, a locked pestware executable object is detected on a storage device of a computer, the locked pestware executable object being inaccessible via the computer's operating system; the locked pestware executable object is accessed through direct drive access; and data in the locked pestware executable object is modified in a manner that renders it harmless to the computer.