Replace malicious driver at boot time

Details Replace malicious driver at boot time Replace malicious driver at boot time

2011-03-29

2011-03-29

Chen, Shin-Hon (Department: 2431)

Information security

Monitoring or scanning of software or data including attack...

C713S188000, C726S023000, C726S024000, C726S025000

Reexamination Certificate

active

07917952

ABSTRACT:
A malicious driver replacement application is installed on a host computer system and registered as a boot execute application. On notification of a malicious driver detection, the malicious driver replacement application reboots the host computer system and locks the volume of a storage disk containing the malicious driver. The malicious driver is replaced directly on the storage disk with a dummy driver having innocuous code. The malicious driver replacement application reboots the host computer system, and on reboot of the host computer system, the dummy driver is loaded rather than the malicious driver thus preventing the malicious driver from interfering with the standard operating system routines and allowing the malicious driver to be remediated.

REFERENCES:
patent: 2007/0022287 (2007-01-01), Beck et al.
patent: 2007/0113062 (2007-05-01), Osburn et al.
patent: 2007/0118646 (2007-05-01), Gassoway
patent: 2008/0005797 (2008-01-01), Field et al.
patent: 2008/0282350 (2008-11-01), Khilnani et al.
patent: 2009/0013409 (2009-01-01), Wenzinger et al.
patent: 2009/0119778 (2009-05-01), Bhuyan
Kennedy, M., et al., U.S. Appl. No. 11/400,538, filed Apr. 6, 2006, entitled “Utilizing Early Exclusive Volume Access and Direct Volume Manipulation to Remove Protected Files” (21 pages, 3 shts).
Naftel, T., et al., U.S. Appl. No. 11/694,711, filed Mar. 30, 2007, entitled “Remediating Malware Infections Through Obfuscation” (19 pages, 3 shts).

Affiliated with

Also associated with

Rating

Replace malicious driver at boot time does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Replace malicious driver at boot time, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Replace malicious driver at boot time will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-2623010