Malware Removal System Preventing Self-Repair via Process Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for removing malicious software from computer systems often result in undesirable consequences, such as abnormal termination of valid processes and incomplete removal, as malicious code can recreate itself upon termination.
Innovation Solution
A method that determines if an attempt to recreate a resource is made, identifies whether the resource is suspicious, and assesses the originating process to take protective actions if it is non-trusted, thereby preventing the recreation of malicious code components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malicious code is removed from the system, then the harmful consequences are eliminated, but the malicious code can restore or recreate itself from stored copies in memory
Solution Approach 1:
The system performs preliminary identification and isolation of malicious code components before complete removal. By detecting the presence of malicious code in memory and separating it from the executable, the system prevents the code from restoring itself after removal, thus achieving complete and permanent elimination.
Solution Approach 2:
The system extracts and isolates the malicious code component from the legitimate executable file. By separating the harmful code from the valid process, the system can remove the malicious portion without affecting the legitimate software, and prevent restoration by maintaining the separation.
2Reliability
If attempts are made to eliminate malicious code, then the malware is removed, but valid processes are abnormally terminated and software programs fail
Solution Approach 1:
The system applies different treatment to different parts of the executable file. By identifying and isolating only the malicious code portion while leaving the legitimate code intact, the system can remove the harmful component without terminating the valid process, thus maintaining system stability while achieving malware removal.
Solution Approach 2:
The system segments the executable file into legitimate code and malicious code components. By dividing the file and treating each segment differently, the system can remove only the malicious segment while preserving the legitimate segment, avoiding abnormal termination of valid processes.
3Reliability
If complete removal of malicious code is attempted, then the malware should be permanently eliminated, but the stored copy in memory restores and recreates removed components
Solution Approach 1:
The system performs preliminary identification and isolation of malicious code in memory before removal. By detecting and separating the malicious code while it is still accessible in memory, the system prevents restoration after removal, achieving complete elimination without requiring complex post-removal monitoring mechanisms.
Solution Approach 2:
The system uses an intermediary mechanism to identify and isolate malicious code components. By introducing this intermediate layer between the malicious code and the removal process, the system can safely eliminate the malware while preventing restoration, without requiring overly complex direct removal procedures.
Data Source
AI summary
A method includes determining if an attempt to recreate a requested resource is made, and, if so, if the requested resource is a suspicious resource. If the requested resource is a suspicious resource, identification of an originating process is made. A determination is made if the originating process is a non-trusted originating process or a trusted originating process. If the originating process is the non-trusted originating process, a protective action is taken. In this manner, self-repairing and persistent malicious code is identified and removed with minimal adverse impact on system functionality.