Trusted operating environment for malware detection
View Patent ↗Techniques and apparatuses for scanning a computing device for malware are described. In one implementation, a trusted operating environment, which includes a trusted operating system and a trusted antivirus tool, is embodied on a removable data storage medium. A computing device is then booted from the removable data storage medium using the trusted operating system. The trusted antivirus tool searches the computing device for malware definition updates (e.g., virus signature updates) and uses the trusted operating system to scan the computing device for malware. In another implementation, a computing device is booting from a trusted operating system on a removable device and a trusted antivirus tool on the removable device scans the computing device for malware. The removable device can update its own internal components (e.g., virus signatures and antivirus tool) by searching the computing device or a remote resource for updates and authenticating any updates that are located.
1. A method comprising:
as part of a computing device boot process, loading, by a removable device, a trusted operating system onto the computing device from the removable device, the removable device including the trusted operating system and an antivirus tool;
launching the antivirus tool from the removable device;
scanning the computing device with the antivirus tool;
searching for one or more removable device component updates; and
scanning the updates with the antivirus tool and writing one or more of the removable device component updates to the removable device in response to any removable device component updates being located.
2. A method as recited in claim 1 , wherein launching the antivirus tool from the removable device comprises loading one or more virus signatures from the removable device.
3. A method as recited in claim 1 , wherein launching the antivirus tool from the removable device comprises:
searching for one or more virus signature updates on the computing device;
authenticating the virus signature updates if any virus signature updates are located; and
utilizing any authenticated virus signature updates to scan the computing device.
4. A method as recited in claim 1 , wherein scanning the computing device with the antivirus tool comprises removing any viruses that are detected and rebooting the computing device using an operating system that is internal to the computing device.
5. A method as recited in claim 1 , wherein the removable device component updates are virus signature updates.
6. A method as recited in claim 1 , wherein the removable device component updates are antivirus tool updates.
7. A method as recited in claim 1 , wherein the searching for one or more removable device component updates is performed at least in part by an update agent on the removable device.
8. A method as recited in claim 1 , wherein writing one or more of the removable device component updates to the removable device comprises:
authenticating the removable device component updates; and
writing only the authenticated removable device component updates to the removable device.
9. A method as recited in claim 8 , wherein the authentication is implemented by an authentication tool on the removable device.
10. A portable device comprising:
a computer-readable memory, the computer-readable memory storing:
a trusted operating system component to be loaded onto the external computing device and to boot the external computing device;
an antivirus tool component to scan the external computing device;
an update agent component to search for one or more portable device component updates, scan the one or more portable device component updates with the antivirus tool, and write one or more of the portable device component updates to the removable device in response to any portable device component updates being located; and
a processor for controlling access to the components of the removable device.
11. A portable device as recited in claim 10 , wherein the computer-readable memory further comprises one or more virus signatures for use by the antivirus tool.
12. A portable device as recited in claim 10 , wherein the update agent is configured to search for the portable device component updates.
13. A portable device as recited in claim 12 , wherein the update agent is configured to search for the portable device component updates on at least one of the external computing device and a resource remote to the external computing device.
14. A portable device as recited in claim 12 , wherein the portable device component updates comprise one or more virus signature updates.
15. A portable device as recited in claim 12 , wherein the portable device component updates comprise one or more antivirus tool updates.
16. A portable device as recited in claim 12 , wherein the computer-readable memory further comprises an authentication tool for authenticating any portable device component updates located by the update agent.
17. A method comprising:
interfacing a removable device with a computing device;
loading, by the removable device, a trusted operating system onto the computing device from the removable device, the removable device including the trusted operating system and an antivirus tool;
locating one or more data files on the computing device to be stored on the removable device;
scanning, by the removable device, the data files with the antivirus tool; and
writing the data files to the removable device.
18. A method as recited in claim 17 , wherein the scanning further comprises removing any viruses that are detected in the files.
19. A method as recited in claim 17 , wherein the removable device comprises a computer-readable memory and a processor.
20. A method as recited in claim 17 , wherein the removable device is a universal serial bus device.