Shutdown Scanner for Malware Detection via Launch Point Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Sophisticated malware programs evade detection by deleting their start-up files from the hard disk during early start-up procedures, making it difficult for anti-virus software to detect and remove them, as they recreate their components during the shutdown period when anti-virus protection is deactivated.
Innovation Solution
Implementing a shutdown scanner that monitors the creation and modification of launch points during the late stages of shutdown, saving copies of executable files to non-volatile memory for subsequent scanning by a malware detection unit to identify and remove potential malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-virus software scans for malware during normal operation, then malware detection capability is improved, but malware can hide by deleting its start-up files during early start-up procedures
Solution Approach 1:
The system performs preliminary scanning of executable files during shutdown procedures, before the system restarts. This timing allows detection of malware that has recreated its start-up files during the shutdown period, when traditional anti-virus monitoring is deactivated. The shutdown scanner captures files before they can be executed in the next boot cycle.
Solution Approach 2:
Instead of scanning for malware during normal operation when malware hides its files, the system inverts the scanning approach by operating during shutdown procedures. This reverse timing approach allows the scanner to detect malware files that have been recreated during shutdown, when the malware believes it is safe from detection.
2Reliability
If anti-virus monitoring is active during shutdown procedures, then malware recreation can be detected, but system performance and resource usage increase
Solution Approach 1:
The shutdown scanner performs a focused scan only on executable files that are created or modified during shutdown procedures, rather than scanning the entire system. This partial action approach detects malware with minimal resource consumption, as it only monitors specific file system changes during the shutdown window.
Solution Approach 2:
The system saves copies of executable files to non-volatile memory during shutdown for subsequent scanning. This copying mechanism allows the malware detection unit to examine files after shutdown without interfering with the shutdown process itself, maintaining system performance while enabling thorough detection.
3Adaptability or versatility
If malware scans for anti-virus software during shutdown, then malware can evade detection by timing its file recreation, but detection coverage is reduced
Solution Approach 1:
The system implements continuous monitoring during shutdown procedures, observing file system changes in real-time. This feedback mechanism allows the shutdown scanner to detect when malware recreates its start-up files during shutdown, counteracting the malware's timing-based evasion strategy. The monitoring provides immediate detection of file creation events.
Solution Approach 2:
The shutdown scanner maintains continuous monitoring of file system changes throughout the entire shutdown procedure, ensuring no malware recreation event goes undetected. This continuous action during the critical shutdown window ensures comprehensive detection coverage regardless of when during shutdown the malware attempts to recreate its files.
Data Source
AI summary
According to a first aspect of the present invention there is provided a method of operating a computer to detect malware, which malware writes a copy of an executable file to a non-volatile memory of the computer and creates a launch point that causes that executable file to be run at start-up of the computer. The method includes, during the shutdown procedures of the computer, monitoring the creation and/or modification of any launch points and, for any such modification or creation, saving a further copy of any executable file associated with the launch point to the non-volatile memory, and, following a subsequent start-up of the computer, examining said further copy to determine if it is potential malware.