Method and system for detecting malware using a secure operating system mode
The present disclosure is directed to a method and system for detecting malware using a secure operating system mode. In accordance with a particular embodiment of the present disclosure a file is received. The file is stored in a secure directory. At least one operation is prevented on the file. A secure operating system mode is started to detect whether the file comprises malware.
1. A method for detecting malware using a secure operating system mode, comprising:
Receiving, by a client computer system, a file;
determining that the file is an executable;
storing the file in a secure directory;
preventing at least one operation on the file; and
in response to determining that the file is the executable, prompting a user to reboot the operating system of the client computer system; and
in response to the user rebooting the client computer system, starting the secure operating system mode to detect whether the file comprises the malware by comparing the file to one or more permitted files while the operating system of the client computer system is in the secure operating system mode, and
wherein starting the secure operating system mode to detect whether the file comprises the malware further comprises detecting whether the file comprises the malware by comparing the file to one or more permitted files while an operating system of the client computer system is in the secure operating system mode by performing booting or rebooting an operating system of the client to change the operating system from a default unsecured mode to the secure operating system mode.
2. The method of claim 1 , wherein preventing the at least one operation on the file comprises encrypting the file.
3. The method of claim 1 , wherein preventing the at least one operation on the file comprises deleting the file.
4. The method of claim 1 , further comprising generating an advisory message for a user that indicates the file comprises the malware.
5. The method of claim 1 , wherein the file comprises an executable file.
6. The method of claim 1 , further comprising allowing the at least one operation on the file if the file does not comprise the malware.
7. The method of claim 1 , wherein:
the file is received and stored on a client that is operable to remotely accessed via a network; and
starting the secure operating system mode to detect whether the file comprises the malware comprises disabling remote access to the client via the network.
8. A system for detecting malware using a secure operating system mode comprising:
a storage device; and
a processor, the processor operable to execute a program of instructions operable to:
receive a file;
determine that the file is an executable;
store the file in a secure directory;
prevent at least one operation on the file; and
in response to determining that the file is the executable, prompt a user to reboot the operating system of the processor; and
in response to the user rebooting the operating system of the processor, start the secure operating system mode to compare the file to one or more permitted files while the operating system of the processor is in the secure operating system model wherein detecting whether the file comprises the malware is performed by comparing the file to one or more permitted files while an operating system of the processor is in the secure operating system mode by performing booting or rebooting an operating system of the client to change the operating system from a default unsecured mode to the secure operating system mode.
9. The system of claim 8 , wherein the program of instructions is further operable to encrypt the file.
10. The system of claim 8 , wherein the program of instructions is further operable to delete the file.
11. The system of claim 8 , wherein the program of instructions is further operable to generate an advisory message for a user that indicates the file comprises the malware.
12. The system of claim 8 , wherein the file comprises an executable file.
13. The system of claim 8 , wherein the program of instructions is further operable to allow the at least one operation on the file if the file does not comprise the malware.
14. The system of claim 8 , wherein:
the processor is operable to be remotely accessed via a network; and
starting the secure operating system mode to detect whether the file comprises the malware comprises disabling remote access to the processor via the network.
15. A non-transitory computer-readable media storing logic operable when executed on a processor to:
receive a file;
determine that the file is an executable;
store the file in a secure directory;
prevent at least one operation on the file; and
in response to determining that the file is the executable, prompt a user to reboot the operating system of the processor; and
in response to the user rebooting the operating system of the processor, start the secure operating system mode to compare the file to one or more permitted files while the operating system of the processor is in the secure operating system mode wherein detecting whether the file comprises the malware is performed by comparing the file to one or more permitted files while an operating system of the processor is in the secure operating system mode by performing booting or rebooting an operating system of the client to change the operating system from a default unsecured mode to the secure operating system mode.
16. The non-transitory computer-readable media of claim 15 , wherein the logic is further operable to encrypt the file.
17. The non-transitory computer-readable media of claim 15 , wherein the logic is further operable to delete the file.
18. The non-transitory computer-readable media of claim 15 , wherein the logic is further operable to generate an advisory message for a user that indicates the file comprises the malware.
19. The non-transitory computer-readable media of claim 15 , wherein the file comprises an executable file.
20. The non-transitory computer-readable media of claim 15 , wherein the logic is further operable to allow the at least one operation on the file if the file does not comprise the malware.
21. The logic of claim 15 , wherein:
the file is received and stored on a client that is operable to remotely accessed via a network; and
starting the secure operating system mode to detect whether the file comprises the malware comprises disabling remote access to the client via the network.