Granted Patent B2

US 9,754,102 · App. 14/507,657 · Granted Sep 5, 2017

Inventor: Jerome L. Schneider (Boulder, CO)

Assignee: Webroot Inc.

G06F21/51G06F21/554G06F21/56G06F21/566

Abstract

Claims (43)

1. A device-comprising:

at least one processor; and

a memory encoding computer executable instructions that, when executed by the at least one processor, perform a method comprising:

monitoring events during a boot sequence of the computer; managing pestware-related events during a first period in a boot sequence of the computer, the first period in the boot sequence occurring before the computer becomes configured to run native applications, before a subsystem of an operating system is loaded, and after a kernel is loaded;

managing pestware-related events in accordance with a set of behavior rules during a second period in the boot sequence occurring when the computer is configured to run native applications;

generating, in response to the monitoring, a record of events, the record of events including the pestware-related events;

analyzing the record of events so as to identify the pestware-related events; modifying the set of behavior rules so as to prevent the pestware related events;

and

scanning a registry of the computer for pestware during the second period in the boot sequence.

2. The device of claim 1 , wherein the method further comprises launching, after an operating system is initiated, a pestware management engine; and

wherein the set of behavior rules includes behavior rules compiled by the pestware management engine.

3. The device of claim 1 , wherein the record of events includes information selected from the group consisting of: process identification information, file identification information, and hook generation information.

4. The device of claim 1 , wherein the method further comprises managing pestware-related events after the computer becomes configured to run native applications.

5. The device of claim 1 , wherein the monitoring includes monitoring the boot sequence while boot drivers are initiated.

6. A system for managing pestware on a computer comprising:

at least one processor;

a memory encoding computer executable instructions that, when executed by the at least one processor, perform a method comprising:

monitoring events during a boot sequence of the computer;

managing pestware-related events during first period in a boot sequence of the computer, the first period in the boot sequence occurring before the computer becomes configured to run native applications, before a subsystem is loaded, and after a kernel is loaded;

managing pestware-related events in accordance with a set of behavior rules during a second period in the boot sequence occurring when the computer is configured to run native applications;

generating, in response to the monitoring, a record of events, the record of events including the pestware-related events;

analyzing the record of events so as to identify the pestware-related events; and

modifying the set of behavior rules so as to prevent the pestware related events; and

scanning a registry of the computer for pestware during the second period in the boot sequence.

7. The system of claim 6 , wherein the method further comprises launching, after an operating system is initiated, a pestware management engine; and wherein the set of behavior rules includes behavior rules compiled by the pestware management engine.

8. The system of claim 6 , wherein the record of events includes information selected from the group consisting of: process identification information, file identification information, and hook generation information.

9. The system of claim 6 , wherein the method further comprises

managing pestware-related events after the computer becomes configured to run native applications.

10. The system of claim 6 , wherein the method further comprises monitoring the boot sequence while boot drivers are initiated.

11. A hard drive comprising computer executable instructions that, when executed by at least one processor, perform a method comprising:

monitoring events during a boot sequence of a computer;

managing pestware-related events during a first period in a boot sequence of the computer, the first period in the boot sequence occurring before the computer becomes configured to run native applications, before a subsystem is loaded, and after a kernel is loaded;

managing pestware-related events in accordance with a set of behavior rules during a second period in the boot sequence occurring when the computer is configured to run native applications;

generating, in response to the monitoring, a record of events, the record of events including the pestware-related events;

analyzing the record of events so as to identify the pestware-related events; and

modifying the set of behavior rules so as to prevent the pestware related events; and

scanning a registry of the computer for pestware during the second period in the boot sequence.

12. The hard drive of claim 11 further comprising program instructions for launching, after an operating system is initiated, a pestware management engine; and

wherein the set of behavior rules includes behavior rules compiled by the pestware management engine.

13. The hard drive of claim 11 , wherein the record of events includes information selected from the group consisting of: process identification information, file identification information, and hook generation information.

14. The hard drive of claim 11 further comprising program instructions for:

managing pestware-related events after the computer becomes configured to run native applications.

15. The hard drive of claim 11 , wherein the monitoring includes monitoring the boot sequence while boot drivers are initiated.

Assignments (9)

Continuity (3)