System, method and computer program product for accelerating malware/spyware scanning
View Patent ↗A system, method and computer program product are provided for scanning files. A plurality of file names in a registry of a computer is identified. By this identification, files associated with the file names are scanned. Another system, method and computer program product are further provided. In particular, a change in a registry of a computer is first identified. Then, a scan is conditionally performed based on whether the change in the registry is identified.
1. A method for scanning files, comprising:
determining whether a scan is scheduled;
if it is determined that the scan is scheduled:
identifying a plurality of file names in a registry of a computer, utilizing a processor; and
scanning files associated with the file names, where the files with associated file names in the registry are scanned; and
identifying a change in the registry of the computer;
wherein duplicate file names are removed;
wherein the determining whether the scan is scheduled is performed in parallel with the identifying the change in the registry of the computer.
2. A method for scanning files, comprising:
determining whether a scan is scheduled;
if it is determined that the scan is scheduled:
identifying a plurality of file names in a registry of a computer, utilizing a processor; and
scanning files associated with the file names, where the files with associated file names in the registry are scanned; and
identifying a change in the registry of the computer;
wherein the files are scanned for spyware;
wherein the determining whether the scan is scheduled is performed in parallel with the identifying the change in the registry of the computer.
3. The method as recited in claim 2 , wherein the spyware includes adware.
4. The method as recited in claim 2 , wherein the spyware includes dialer software.
5. The method as recited in claim 2 , wherein a first time required for the scanning is less than a second time required for scanning files stored on harddisks of the computer.
6. The method as recited in claim 2 , wherein the registry includes a location on the computer for storing information including at least one of hardware that is attached to the computer, system options that have been selected, a configuration of memory of the computer, and application programs to be present when an operating system of the computer is started.
7. The method as recited in claim 2 , wherein the method is utilized to counter terrorism by preventing infection of cyber-frameworks with malware initiated by terrorists.
8. The method as recited in claim 2 , wherein the file names are identified utilizing a predetermined format associated therewith.
9. The method as recited in claim 8 , wherein the format includes a path.
10. The method as recited in claim 9 , wherein the path includes a drive letter.
11. The method as recited in claim 8 , wherein the predetermined format includes the form: <drive letter><colon><backslash><path><name>.
12. The method as recited in claim 8 , wherein the predetermined format distinguishes the names from other alphanumeric data in the registry of the computer.
13. The method as recited in claim 2 , wherein the files are scanned for malware.
14. A method, comprising:
identifying a change in a registry of a computer, utilizing a processor;
conditionally performing a scan based on whether the change in the registry is identified, where the conditional scan is performed in order to identify malware or spyware that caused the change; and
determining whether a scan is scheduled;
wherein the conditional scan includes scanning at least one file and scanning each of a plurality of files identified in the registry;
wherein the identifying the change in the registry of the computer is performed in parallel with the determining whether the scan is scheduled.
15. The method as recited in claim 14 , wherein the conditional scan includes scanning for malware.
16. The method as recited in claim 14 , wherein the conditional scan includes scanning for spyware.
17. The method as recited in claim 16 , wherein the spyware includes adware.
18. The method as recited in claim 16 , wherein the spyware includes dialer software.
19. The method as recited in claim 14 , wherein a first time required for the conditional scan is less than a second time required for scanning files stored on harddisks of the computer.
20. The method as recited in claim 14 , wherein the registry includes a location on the computer for storing information including at least one of hardware that is attached to the computer, system options that have been selected, a configuration of memory of the computer, and application programs to be present when an operating system of the computer is started.
21. The method as recited in claim 14 , wherein the method is utilized to counter terrorism by preventing infection of cyber-frameworks with malware initiated by terrorists.
22. The method as recited in claim 14 , wherein the change includes a change to any file name in the registry.
23. The method as recited in claim 14 , wherein the registry is continuously monitored for identifying the change.
24. The method as recited in claim 14 , wherein a scheduled scan is performed on a periodic basis.
25. The method as recited in claim 24 , wherein the conditional scan is performed prior to the scheduled scan.
26. The method as recited in claim 24 , wherein the conditional scan is performed in parallel with the scheduled scan.
27. The method as recited in claim 14 , wherein the conditional scan includes scanning the registry.
28. The method as recited in claim 27 , wherein the scanning of the registry includes scanning the registry for at least one predetermined key.
29. The method as recited in claim 28 , wherein the at least one predetermined key is deleted upon detection thereof.
30. A method, comprising:
identifying a change in a registry of a computer, the change including a change to any file in the registry, utilizing a processor;
conditionally performing a scan based on whether the change in the registry is identified, where the conditional scan is performed in order to identify malware or spyware that caused the change; and
determining whether a scan is scheduled;
wherein the conditional scan includes scanning at least one file;
wherein the at least one file includes only files associated with a changed file name;
wherein the identifying the change in the registry of the computer is performed in parallel with the determining whether the scan is scheduled.
31. A method, comprising:
determining whether a scan is scheduled, utilizing a processor;
if it is determined that the scan is scheduled:
identifying a plurality of file names in a registry of a computer,
removing duplicate file names in the registry of the computer, and
scanning files associated with the file names for spyware and malware;
identifying a change in the registry of the computer; and
if the change in the registry is identified:
identifying the file names in the registry of the computer,
removing the duplicate file names in the registry of the computer,
scanning the files associated with the file names for the spyware and the malware,
scanning the registry for predetermined keys, and
removing the predetermined keys;
wherein the determining whether the scan is scheduled and the identifying the change in the registry of the computer are performed in parallel.