System, method, and computer program product for removing malware from a system while the system is offline
View Patent ↗A system, method, and computer program product are provided for removing malware from a system while the system is offline. In use, a system is identified as being infected with malware. Additionally, it is determined whether the malware can be fully removed from the system while the system is online. Further, at least part of the malware is conditionally removed from the system while the system is offline, based on the determining.
1. A computer program product embodied on a non-transitory computer readable medium comprising instructions stored thereon to cause one or more processors to:
identify a system as being infected with malware while the system in online mode;
identify portions of the malware that can be fully removed from the system while the system remains in online mode;
determine that at least a portion of the malware cannot be removed while the system remains in online mode;
create, while the system is in online mode, a list of tasks to fully remove the malware from the system while the system is in offline mode, the list of tasks providing a description of actions required to fully remove the malware;
obtain the list of tasks in a pre-boot environment while the system is in offline mode, wherein the pre-boot environment is provided by a chipset extension of the one or more processors; and
process the list of tasks to complete removal of the malware while the system is in the pre-boot environment and in offline mode, wherein the system is in offline mode when the system is in the pre-boot environment and the system is not executing code of an operating system, a basic input output system (BIOS), or booting the operating system.
2. The computer program product of claim 1 , wherein the system is concurrently executing code of the operating system while identifying the system as being infected and creating the list of tasks.
3. The computer program product of claim 1 , wherein the instructions to cause the one or more processors to determine that at least a portion of the malware cannot be removed include instructions to cause the one or more processors to determine that one or more files in the system associated with the malware are in use.
4. The computer program product of claim 1 , wherein the instructions to cause the one or more processors to determine that at least a portion of the malware cannot be removed include instructions to cause the one or more processors to determine that one or more files in the system associated with the malware are locked against modification.
5. The computer program product of claim 1 , wherein the instructions to cause the one or more processors to determine that at least a portion of the malware cannot be removed include instructions to cause the one or more processors to determine that one or more executables associated with the malware have already been loaded in a boot process.
6. The computer program product of claim 5 , wherein the one or more executables associated with the malware include one or more drivers.
7. The computer program product of claim 1 , wherein the instructions to cause the one or more processors to determine that at least a portion of the malware cannot be removed include instructions to cause the one or more processors to determine that the system has imposed one or more restrictions against a modification of one or more files associated with the malware.
8. The computer program product of claim 1 , wherein the computer program product is operable such that the removal of the malware from the system includes deleting one or more files associated with the malware from the system.
9. The computer program product of claim 1 , further comprising instructions to cause the one or more processors to determine whether a repair validation of the system is needed.
10. The computer program product of claim 9 , further comprising instructions to cause the one or more processors to perform one or more actions on the system while the system is in offline mode in response to a determination that the repair validation of the system is needed.
11. The computer program product of claim 1 , further comprising instructions to cause the one or more processors to remove a portion of the malware from the system while the system is in online mode prior to processing the list of tasks in offline mode.
12. The computer program product of claim 1 , further comprising instructions to cause the one or more processors to remove an entirety of the malware from the system while the system is in offline mode.
13. The computer program product of claim 1 , wherein a storage area outside the system is utilized while removing at least the portion of the malware from the system while the system is in offline mode.
14. The computer program product of claim 13 , wherein the storage area outside the system includes a persistent storage area.
15. A method, comprising:
identifying a system as being infected with malware while the system in online mode;
identifying and removing portions of the malware that can be fully removed from the system while the system remains in online mode;
determining that at least a portion of the malware cannot be removed while the system remains in online mode;
creating, while the system is in online mode, a list of tasks to fully remove the malware from the system while the system is in offline mode, the list of tasks providing a description of actions required to fully remove the malware;
obtaining the list of tasks in a pre-boot environment while the system is in offline mode, wherein the pre-boot environment comprises an operating mode provided by a chipset extension of one or more hardware processors; and
processing the list of tasks to complete removal of the malware while the system is operating in the pre-boot environment and in offline mode, wherein the system is in offline mode when the system is in the pre-boot environment and the system is not executing code of an operating system, a basic input output system (BIOS), or booting the operating system.
16. The method of claim 15 , further comprising removing a portion of the malware from the system while the system is in online mode prior to processing the list of tasks.
17. The method of claim 15 , further comprising removing an entirety of the malware from the system while the system is in offline mode.
18. A system, comprising:
one or more processors; and a memory;
wherein the memory stores instructions to cause the one or more processors to:
identify the system as being infected with malware while the system in online mode;
identify and remove portions of the malware that can be fully removed from the system while the system remains in online mode;
determine that at least a portion of the malware cannot be removed while the system remains in online mode;
create, while the system is in online mode, a list of tasks to fully remove the malware from the system while the system is in offline mode, the list of tasks providing a description of actions required to fully remove the malware;
obtain the list of tasks in a pre-boot environment while the system is in offline mode, wherein the pre-boot environment is an operating mode provided by a chipset extension of the one or more processors; and
process the list of tasks to complete removal of the malware while the system is operating in the pre-boot environment and in offline mode, wherein the system is in offline mode when the system is in the pre-boot environment and the system is not executing code of an operating system, a basic input output system (BIOS), or booting the operating system.
19. The system of claim 18 , wherein the instructions to cause the one or more processors to remove a portion of the malware from the system while the system is in online mode prior to processing the list of tasks.
20. The system of claim 18 , further comprising instructions to cause the one or more processors to remove all of the malware from the system while the system is in offline mode.