Generating options for repairing a computer infected with malicious software
View Patent ↗A security module interfaces with a set of infection repair modules. Each repair module can perform a specific repair of an infection. Some of the repair modules utilize context information about the computer, such as the availability of a non-infected backup file. Further, the repairs performed by some repair modules are fine-grained while repairs of other repair modules are coarse-grained. The security module identifies malicious software infecting a computer and generates an infection object for each infection. The security module selectively routes the infection objects to the repair modules. In response, the repair modules provide repair objects representing repairs that the repair modules can perform on the infection. The repair objects have scores describing their thoroughness and complexity. The security module ranks the repair objects based on their scores and selects certain repairs for repairing the malicious software infections.
1. A computer system for generating options for repairing a computer infected by malicious software, the system comprising:
an infection object routing module adapted to receive a set of infection objects describing malicious software infections detected on the computer and to selectively provide the infection objects to a set of repair modules;
a repair management module adapted to interface with the set of repair modules, each repair module adapted to:
receive at least one of the infection objects describing a malicious software infection on the computer,
determine whether the repair module can repair the infection described by the infection object, and responsive to a positive determination, generate a repair object representing a repair that the repair module can perform, the repair object generated including a score describing a metric of thoroughness and complexity of the repair;
a repair object routing module adapted to receive a plurality of the repair objects generated by the repair modules responsive to the provided infection objects; and
a malware repair module adapted to select, for each infection object, one of the plurality of repair objects generated by the set of repair modules based on the scores of the plurality of the repair objects or on input from an end user of the computer regarding a repair represented by one of the plurality of repair objects.
2. The system of claim 1 , wherein the repair object routing module is further adapted to rank the repair objects based on their scores.
3. The system of claim 1 , wherein at least one of the repair modules is adapted to generate the score for the repair object describing the metric, wherein the metric comprises:
a thoroughness metric describing how thorough the repair represented by the repair object is in repairing the infection described by the infection object; and
a complexity metric describing a complexity of the repair represented by the repair object.
4. The system of claim 1 , wherein the repair management module is adapted to interface with at least one of the repair modules that analyzes context information about the computer to determine whether it can repair the infection described by the infection object.
5. The system of claim 4 , wherein the context information is one or more types of context information selected from the set consisting of:
information describing whether a non-infected version of an infected item is available to be restored in place of the infected item;
information describing whether an installer is available to repair the infection described by the infection object;
information describing a number of infections present on the computer;
information describing the source of the infected item; and
information describing file system attributes of the infected item.
6. The system of claim 1 , wherein the malware repair module is further adapted to select one or more of the repairs represented by the repair objects responsive to the scores satisfying a threshold.
7. A computer program product having a computer-readable medium having tangibly embodied therein computer program instructions for generating options for repairing a computer infected by malicious software, comprising:
an infection object routing module adapted to receive a set of infection objects describing malicious software infections detected on the computer and to selectively provide the infection objects to a set of repair modules;
a repair management module adapted to interface with the set of repair modules, each repair module adapted to:
receive at least one of the infection objects describing a malicious software infection on the computer,
determine whether the repair module can repair the infection described by the infection object, and responsive to a positive determination, generate a repair object representing a repair that the repair module can perform, the repair object generated including a score describing a metric of thoroughness and complexity of the repair;
a repair object routing module adapted to receive a plurality of the repair objects generated by the repair modules responsive to the provided infection objects; and
a malware repair module adapted to select, for each infection object, one of the plurality of repair objects generated by the set of repair modules based on the scores of the plurality of the repair objects or on input from an end user of the computer regarding a repair represented by one of the plurality of repair objects.
8. The computer program product of claim 7 , wherein the repair object routing module is further adapted to rank the repair objects based on their scores.
9. The computer program product of claim 7 , wherein at least one of the repair modules is adapted to generate the score for the repair object describing the metric, wherein the metric comprises:
a thoroughness metric describing how thorough the repair represented by the repair object is in repairing the infection described by the infection object; and
a complexity metric describing a complexity of the repair represented by the repair object.
10. The computer program product of claim 7 , wherein the repair management module is adapted to interface with at least one of the repair modules that analyzes context information about the computer to determine whether it can repair the infection described by the infection object.
11. The computer program product of claim 10 , wherein the context information is one or more types of context information selected from the set consisting of:
information describing whether a non-infected version of an infected item is available to be restored in place of the infected item;
information describing whether an installer is available to repair the infection described by the infection object;
information describing a number of infections present on the computer;
information describing the source of the infected item; and
information describing file system attributes of the infected item.
12. The computer-program product of claim 7 , wherein the malware repair module is further adapted to select one or more of the repairs represented by the repair objects responsive to the scores satisfying a threshold.
13. A computer-implemented method for generating options for repairing a computer infected by malicious software, comprising:
receiving a set of infection objects describing malicious software infections detected on the computer;
selectively providing the infection objects to a set of repair modules;
interfacing with a set of repair modules, each repair module adapted to:
receive at least one of the infection objects describing a malicious software infection on the computer,
determine whether the repair module can repair the infection described by the infection object, and responsive to a positive determination, generate a repair object representing a repair that the repair module can perform, the repair object generated including a score describing a metric of thoroughness and complexity of the repair;
receiving a plurality of the repair objects generated by the repair modules responsive to the provided infection objects; and
selecting, for each infection object, one of the plurality of repair objects generated by the set of repair modules based on the scores of the plurality of the repair objects or on input from an end user of the computer regarding a repair represented by one of the plurality of repair objects.
14. The method of claim 13 , further comprising:
ranking the repair objects based on their scores.
15. The method of claim 13 , wherein the metric of thoroughness and complexity of a score comprising:
a thoroughness metric describing how thorough the repair represented by the repair object is in repairing the infection described by the infection object; and
a complexity metric describing a complexity of the repair represented by the repair object.
16. The method of claim 13 , wherein the interfacing comprises:
interfacing with at least one of the repair modules that analyzes context information about the computer to determine whether it can repair the infection described by the infection object.
17. The method of claim 16 , wherein the context information is one or more types of context information selected from the set consisting of:
information describing whether a non-infected version of an infected item is available to be restored in place of the infected item;
information describing whether an installer is available to repair the infection described by the infection object;
information describing a number of infections present on the computer;
information describing the source of the infected item; and
information describing file system attributes of the infected item.
18. A computer system for generating options for repairing a computer infected by malicious software, the system comprising:
infection object routing means adapted to receive a set of infection objects describing malicious software infections detected on the computer and to selectively provide the infection objects to a set of repair modules;
repair management means for interfacing with the set of repair modules, each repair module adapted to:
receive at least one of the infection objects describing a malicious software infection on the computer,
determine whether the repair module can repair the infection described by the infection object, responsive to a positive determination, generate a repair object representing a repair that the repair module can perform, the repair object generated including a score describing a metric of thoroughness and complexity of the repair object routing means for receiving a plurality of the repair objects generated by the repair modules responsive to the provided infection objects; and
malware repair means for selecting, for each infection object, one of the plurality of repair objects generated by the set of repair modules based on the scores of the plurality of the repair objects or on input from an end user of the computer regarding a repair represented by one of the plurality of repair objects.