System, method, and computer program product for identifying a file used to automatically launch content as unwanted
A system, method, and computer program product are provided for identifying a file utilized to automatically launch content as unwanted. In one embodiment, a file is identified in response to a detection of unwanted code, the file utilized to automatically launch content. Additionally, it is determined whether an identifier associated with the unwanted code is included in the file. Further, the file is identified as unwanted based on the determination.
1. One or more storage devices comprising instructions that when executed cause one or more processors to at least:
perform a first scan of a computer system;
detect, during the first scan, a first file on the computer system, the first file known to be a malicious file;
delete or quarantine the first file;
determine whether the first file is of a type to be automatically launched via a second file different than the first file, the second file to automatically launch the first file by initiating execution of the first file;
in response to the determination that the first file is of the type to be automatically launched via the second file, perform a second scan of the computer system to locate the second file; and
delete the second file.
2. The one or more storage devices of claim 1 , wherein the second file is stored on a removable storage device.
3. The one or more storage devices of claim 2 , wherein the first file is stored on the removable storage device.
4. The one or more storage devices of claim 1 , wherein the first file includes obfuscated code.
5. The one or more storage devices of claim 1 , wherein the second file includes a pointer to the first file.
6. The one or more storage devices of claim 1 , wherein the instructions, when executed, cause the one or more processors to locate the second file by scanning the second file for an identifier associated with the first file.
7. The one or more storage devices of claim 6 , wherein the identifier associated with the first file includes a file name of the first file.
8. The one or more storage devices of claim 6 , wherein the identifier associated with the first file includes a path name to the first file.
9. The one or more storage devices of claim 1 , wherein the second file is an autorun.inf file.
10. The one or more storage devices of claim 1 , wherein the processor is to determine whether the first file is of the type to be automatically launched via the second file by querying a database of known malware.
11. A method, comprising:
performing a first scan of a computer system;
detecting, during the first scan, a first file on the computer system, the first file known to be a malicious file;
deleting or quarantining the first file;
determining whether the first file is of a type to be automatically launched via a second file, the second file different than the first file, the second file to automatically launch the first file by initiating execution of the first file;
in response to the determination that the first file is of the type to be automatically launched via the second file, performing a second scan of the computer system to locate the second file; and
deleting the second file.
12. The method of claim 11 , wherein the second file is stored on a removable storage device and the second scan is performed on the removable storage device.
13. The method of claim 12 , wherein the first file is stored on the removable storage device.
14. The method of claim 11 , wherein the first file includes obfuscated code.
15. The method of claim 11 , wherein the second file includes a pointer to the first file.
16. The method of claim 11 , wherein the performing of the second scan includes scanning the second file for an identifier associated with the first file.
17. The method of claim 16 , wherein the identifier associated with the first file includes a file name of the first file.
18. The method of claim 11 , wherein the performing of the second scan includes determining that an identifier associated with the first file is included in the second file.
19. The method of claim 11 , wherein the second file is an autorun.inf file.
20. The method of claim 11 , wherein the determining whether the first file is of the type to be automatically launched via the second file includes querying a database of known malware.
21. A computer system, comprising:
a processor; and
a memory including instructions, that, when executed, cause the processor to:
perform a first scan of the computer system;
detect, during the first scan, a first file on the computer system, the first file known to be a malicious file;
delete or quarantine the first file;
determine whether the first file is of a type to be automatically launched via a second file different than the first file, the second file to automatically launch the first file by initiating execution of the first file;
in response to the determination that the first file is of the type to be automatically launched via the second file, perform a second scan of the computer system to locate the second file; and
delete the second file.
22. The computer system of claim 21 , wherein the second file is stored on a removable storage device and the second scan is performed on the removable storage device.
23. The computer system of claim 22 , wherein the first file is stored on the removable storage device.
24. The computer system of claim 21 , wherein the first file includes obfuscated code.
25. The computer system of claim 21 , wherein the second file includes a pointer to the first file.
26. The computer system of claim 21 , wherein the instructions when executed cause the processor to scan the second file for an identifier associated with the first file.
27. The computer system of claim 21 , wherein the instructions cause the processor to locate the second file by scanning the second file for an identifier associated with the first file.
28. The computer system of claim 27 , wherein the identifier associated with the first file includes a file name of the first file.
29. The computer system of claim 21 , wherein the instructions cause the processor to locate the second file by determining that an identifier associated with the first file is included in the second file.
30. The computer system of claim 21 , wherein the second file is an autorun.inf file.
31. The computer system of claim 21 , wherein the processor is to determine whether the first file is of the type to be automatically launched via the second file by querying a database of known malware.