Systems and methods for automatically recovering from malware attacks
The disclosed computer-implemented methods for automatically recovering from malware attacks may include (1) saving, in response to determining that a reputation of a process is unknown, a backup copy of a file on a remote storage device prior to allowing the process to modify the file; (2) determining, after the process has modified the file, that the process is potentially malicious; and (3) restoring, in response to determining that the process is potentially malicious, the backup copy of the file from the remote storage device. The provided methods may automatically recover computers from ransomware attacks and other malware attacks which encrypt file systems. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for automatically recovering from malware attacks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying, at the computing device, an attempt by a process to modify a file;
determining that the process has an unknown reputation;
saving, in response to determining that the reputation of the process is unknown, a backup copy of the file on a remote storage device prior to allowing the process to modify the file;
determining, after the process has modified the file, after a defined period of time following saving the backup copy of the file, and from the backup copy of the file, that the process is potentially malicious, wherein the defined period of time is based on observed lengths of ransomware attacks; and
restoring, in response to determining that the process is potentially malicious, the backup copy of the file from the remote storage device.
2. The method of claim 1 , further comprising:
tagging the backup copy of the file with metadata that indicates that the backup copy of the file was created prior to allowing the process with the unknown reputation to modify the file; and
selecting, based on the metadata, the backup copy of the file for restoring the computing device.
3. The method of claim 1 , further comprising marking, when a malware attack is not detected during a safe period, the process as having a good reputation.
4. The method of claim 1 , further comprising determining the process is potentially malicious from a process-modified version of the file.
5. The method of claim 1 , further comprising deleting, responsive to identifying the reputation of the process, a process-modified version of the file.
6. The method of claim 1 , wherein the restoring is automatic in response to determining that the process is potentially malicious.
7. The method of claim 1 , further comprising prompting a user for permission to restore the backup copy of the file.
8. The method of claim 1 , further comprising:
identifying, based on the reputation of the process, a potential security risk associated with the process; and
performing, in response to identifying the potential security risk, a security action in an attempt to ameliorate the potential security risk.
9. A system for automatically recovering from malware attacks, the system comprising:
a memory device;
an identifying module, stored in the memory device, that identifies an attempt by a process to modify a file;
a first determining module, stored in the memory device, that determines that the process has an unknown reputation;
a saving module, stored in the memory device, that saves, in response to determining that the reputation of the process is unknown, a backup copy of the file on a remote storage device prior to allowing the process to modify the file;
a second determining module, stored in the memory device, that determines, after the process has modified the file, after a defined period of time following saving the backup copy of the file, and from the backup copy of the file, that the process is potentially malicious, wherein the defined period of time is based on observed lengths of ransomware attacks;
a restoring module, stored in the memory device, that restores, in response to determining that the process is potentially malicious, the backup copy of the file from the remote storage device; and
at least one physical processor that executes the identifying module, the first determining module, the saving module, the second determining module, and the restoring module.
10. The system of claim 9 , further comprising:
a tagging module, stored in the memory device, that tags the backup copy of the file with metadata that indicates that the backup copy of the file was created prior to allowing the process with the unknown reputation to modify the file; and
a selecting module, stored in the memory device, that selects, based on the metadata, the backup copy of the file for restoring the system.
11. The system of claim 9 , wherein the second determining module marks, when a malware attack is not detected during a safe period, the process as having a good reputation.
12. The system of claim 9 , wherein the second determining module determines the process is potentially malicious from a process-modified version of the file.
13. The system of claim 9 , further comprising a deleting module, stored in the memory device, that deletes, responsive to identifying the reputation of the process, a process-modified version of the file.
14. The system of claim 9 , wherein the restoring module automatically restores the backup copy of the file from the remote storage device in response to determining that the process is potentially malicious.
15. The system of claim 9 , further comprising a prompting module, stored in the memory device, that prompts a user for permission to restore the backup copy of the file.
16. The system of claim 9 , further comprising:
a second identifying module, stored in the memory device, that identifies, based on the reputation of the process, a potential security risk associated with the process; and
a performing module, stored in the memory device, that performs, in response to identifying the potential security risk, a security action in an attempt to ameliorate the potential security risk.
17. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify, at the computing device, an attempt by a process to modify a file;
determine that the process has an unknown reputation;
save, in response to determining that the reputation of the process is unknown, a backup copy of the file on a remote storage device prior to allowing the process to modify the file;
determine, after the process has modified the file, after a defined period of time following saving the backup copy of the file, and from the backup copy of the file, that the process is potentially malicious, wherein the defined period of time is based on observed lengths of ransomware attacks; and
restore, in response to determining that the process is potentially malicious, the backup copy of the file from the remote storage device.
18. The non-transitory computer-readable medium of claim 17 , further comprising one or more computer-executable instructions that, when executed by the at least one processor of the computing device, cause the computing device to mark, when a malware attack is not detected during a safe period, the process as having a good reputation.
19. The non-transitory computer-readable medium of claim 17 , wherein the computer-executable instructions that cause the computing device to restore the backup copy of the file from the remote storage device comprise computer-executable instructions to cause the computing device to automatically restore the backup copy of the file from the remote storage device in response to determining that the process is potentially malicious.
20. The non-transitory computer-readable medium of claim 17 , further comprising one or more computer-executable instructions that, when executed by the at least one processor of the computing device, cause the computing device to delete, responsive to identifying the reputation of the process, a process-modified version of the file.