Method and system to detect malicious software

1. A method of detecting a malicious entity in a processing system, wherein the method comprises:

booting the processing system into a boot module prior to loading an operating system;

detecting, using the boot module, if the processing system comprises a malicious entity, wherein the malicious entity modifies an object relating to the operating system;

determining, using the boot module, whether the modified object is used to load the operating system; and

in response to not using the modified object to load the operating system, disabling, using a disable module, the malicious entity and the modified object.

2. The method according to claim 1 , wherein the boot module comprises a detection module, wherein the method comprises analysing, using the detection module, one or more data storage components of the processing system to determine whether the malicious entity has infected the processing system.

3. The method according to claim 2 , wherein the detection module comprises a plurality of submodules comprising at least one of a cryptographic hash module, a checksum module, a disassembly module, a black-list/white-list module, a relationship analysis module, and a pattern matching module, wherein the method comprises analysing, using the plurality of submodules, the data storage components of the processing system to determine whether the malicious entity has infected the processing system.

4. The method according to claim 3 , wherein the method comprises:

generating, using the cryptographic hash module, a cryptographic hash value of an entity stored on the data storage component of the processing system; and

comparing the cryptographic hash value to a database to determine whether the entity is malicious, wherein the database comprises a plurality of cryptographic hash values identifying malicious entities.

5. The method according to claim 3 , wherein the method comprises:

generating, using the checksum module, a checksum value of an entity stored on the data storage component of the processing system; and

comparing, using the black-list/white-list module, the checksum value to a list to determine whether the entity is malicious, wherein the list comprises records indicative of malicious entities and non-malicious entities.

6. The method according to claim 3 , wherein the method comprises:

disassembling, using the disassembly module, an entity stored on the data storage component of the processing system; and

performing a comparison, using the pattern matching module, between the disassembled entity and a list of patterns associated with malicious activity.

7. The method according to claim 3 , wherein in the event that an entity stored on the data storage component of the processing system is determined to be malicious, the method comprises:

(a) setting the malicious entity as a base entity;

(b) determining an entity property of the base entity;

(c) determining, using the relationship analysis module, one or more related entities to the base entity which are related by the entity property; and

(d) performing, using the detection module, an analysis of the related entities to determine if one or more of the related entities are malicious.

8. The method according to claim 7 , wherein the method comprises:

setting the one or more related entities as the base entity; and

repeating steps (b) and (c), followed by step (d) until an end condition is satisfied.

9. The method according to claim 8 , wherein the end condition is at least one of:

when no related entities are determined in a particular repetition;

when no new related entities are determined in a particular repetition;

when no related entities are determined in a period of time;

when the base entity has an entity property which is indicative of the end condition; and

when a selected number of repetitions have been performed.

10. The method according to claim 1 , wherein the disable module comprises at least one of a repair module, a removal module and an injection module.

11. The method according to claim 10 , wherein in the event that a malicious entity is detected, the method comprises repairing, using the repair module, at least a portion of data stored on the data storage component of the processing system comprising at least one of:

writing uncompromised data over at least a portion of the detected malicious entity; and

copying, from an uncompromised data source, uncompromised data over at least a portion of the detected malicious entity.

12. The method according to claim 10 , wherein in the event that a malicious entity is detected, the method comprises injecting, using the injection module, data into the data storage component to disable the malicious entity performing malicious activity.

13. A system of detecting a malicious entity in a processing system, wherein the system comprises:

a processor;

memory in electronic communication with the processor;

a boot module configured to:

boot prior to the processing system loading an operating system;

detect if the processing system comprises a malicious entity, wherein the malicious entity modifies an object relating to the operating system;

determine whether the modified object is used to load the operating system; and

a disable module configured to:

in response to the modified object not being used to load the operating system, disable the malicious entity and the modified object.

14. The system according to claim 13 , wherein the boot module comprises a detection module, wherein the boot detection module is configured to analyse one or more data storage components of the processing system to determine whether the malicious entity has infected the processing system.

15. The method according to claim 14 , wherein the detection module comprises a plurality of submodules comprising at least one of a cryptographic hash module, a checksum module, a disassembly module, a black-list/white-list module, a relationship analysis module, and a pattern matching module.

16. The system according to claim 13 , wherein the disable module comprises at least one of a repair module, a removal module and an injection module.

17. A computer program product embedded in a non-transitory computer storage readable medium having a computer program recorded therein or thereon, when executed by a processor, results in a machine performing the functions of:

boot the processing system into a boot module prior to loading an operating system;

detect, using the boot module, if the processing system comprises a malicious entity, wherein the malicious entity modifies an object relating to the operating system;

determine, using the boot module, whether the modified object is used to load the operating system; and

in response to the modified object not being used to load the operating system, disable, using a disable module, the malicious entity and the modified object.