Preventing and detecting print-provider startup malware
View Patent ↗A method for preventing malware attacks includes detecting an attempt on an electronic device to modify a print service registry, determining an entity associated with the attempt to modify the print service registry, determining a malware status of the entity, and, based on the malware status of the entity, allowing or denying the modification to the print service registry. The print service registry is configured to store configuration information about mechanisms to be used when printing from the electronic device.
1. A method for preventing malware attacks, comprising:
detecting an attempt on an electronic device to modify a print service registry, the print service registry configured to store configuration information about mechanisms to be used when printing from the electronic device;
determining an entity associated with the attempt to modify the print service registry;
determining a malware status of the entity;
based on the malware status of the entity, allowing or denying the modification to the print service registry.
2. The method of claim 1 , further comprising determining the malware status of the entity to be unknown.
3. The method of claim 2 , further comprising allowing the entity with unknown malware status to modify the print service registry.
4. The method of claim 2 , further comprising denying the attempted modification by the entity with unknown malware.
5. The method of claim 1 , further comprising:
determining the malware status of the entity to be safe if the entity has been digitally signed by a trusted author; and
allowing the entity to modify the print service registry.
6. The method of claim 1 , wherein:
the entity is a process running on the electronic device generated from a file on the electronic device; and
determining the malware status of the entity includes determining the malware status of the process and determining the malware status of the file.
7. The method of claim 1 , wherein the modification includes linking to a linked file to be executed upon startup of the electronic device.
8. The method of claim 7 , further comprising:
determining the modification and the linked file;
determining a malware status of the linked file;
based on the malware status of the linked file, allowing or denying the modification to the print service registry.
9. An article of manufacture, comprising:
a non-transitory computer readable medium; and
computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
detect an attempt on an electronic device to modify a print service registry, the print service registry configured to store configuration information about mechanisms to be used when printing from the electronic device;
determine an entity associated with the attempt to modify the print service registry;
determine a malware status of the entity;
based on the malware status of the entity, allow or deny the modification to the print service registry.
10. The article of claim 9 , wherein the processor is further caused to determine that the malware status of the entity is unknown.
11. The article of claim 10 , wherein the processor is further caused to allow the entity with unknown malware to modify the print service registry.
12. The article of claim 10 , wherein the processor is further caused to deny the attempted modification of the print service registry by the entity with unknown malware status.
13. The article of claim 9 , wherein the processor is further caused to:
determine the malware status of the entity to be safe if the entity has been digitally signed by a trusted author; and
allow the entity to modify the print service registry.
14. The article of claim 9 , wherein:
the entity is a process running on the electronic device generated from a file on the electronic device; and
determining the malware status of the entity includes determining the malware status of the process and determining the malware status of the file.
15. The article of claim 9 , wherein the modification includes linking to a linked file to be executed upon startup of the electronic device.
16. The article of claim 15 , wherein the processor is further caused to:
determine the modification and the linked file;
determine a malware status of the linked file;
based on the malware status of the linked file, allow or deny the modification to the print service registry.
17. A system for preventing malware attacks, comprising:
a processor coupled to a memory; and
an anti-malware module executed by the processor, resident within the memory, and communicatively coupled to a print services registry on an electronic device;
the anti-malware module configured to:
detect an attempt on an electronic device to modify a print service registry, the print service registry configured to store configuration information about mechanisms to be used when printing from the electronic device;
determine an entity associated with the attempt to modify the print service registry;
determine a malware status of the entity;
based on the malware status of the entity, allow or deny the modification to the print service registry.
18. The system of claim 17 , wherein the anti-malware module is further configured to determine that the malware status of the entity is unknown.
19. The system of claim 18 , wherein the anti-malware module is further configured to allow the entity with unknown malware to modify the print service registry.
20. The system of claim 18 , wherein the anti-malware module is further configured to deny the attempted modification of the print service registry by the entity with unknown malware status.
21. The system of claim 17 , wherein the anti-malware module is further configured to:
determine the malware status of the entity to be safe if the entity has been digitally signed by a trusted author; and
allow the entity to modify the print service registry.
22. The system of claim 17 , wherein:
the entity is a process running on the electronic device generated from a file on the electronic device; and
determining the malware status of the entity includes determining the malware status of the process and determining the malware status of the file.
23. The system of claim 17 , wherein the modification includes linking to a linked file to be executed upon startup of the electronic device.
24. The system of claim 23 , wherein the anti-malware module is further configured to:
determine the modification and the linked file;
determine a malware status of the linked file;
based on the malware status of the linked file, allow or deny the modification to the print service registry.