Pre-boot firmware based virus scanner

1. A processor implemented method comprising:

during a pre-boot phase of a system having a processor, an operating system (OS) loader, a file system handler, and a pre-boot virus scanner, all operated by the processor, and a boot phase following the pre-boot phase,

invoking the OS loader to load an OS,

invoking, by the OS loader, the file system handler instead of the OS,

loading by the file system handler, files associated with a file system of the OS,

scanning the files loaded by the file system handler by the pre-boot virus scanner, the scanning including

attempting by the pre-boot virus scanner to determine if the scanned files are infected with a virus before attempting to store the scanned files into a memory, and

assigning by the pre-boot virus scanner a virus state to the scanned files based at least in part upon whether the at least one scanned file is or are infected with a virus, and

on completion of the scanning, conditionally loading the OS by the OS loader to transition the system into the boot phase, based at least in part on the results of the scanning by the pre-boot virus scanner.

2. The method of claim 1 , further comprising selecting by the processor a virus database, the selected virus database containing information to facilitate said attempt to determine if the at least one scanned file is or are infected with a virus.

3. The method of claim 1 , wherein the file system handler is in compliance with the Extensible Firmware Interface (EFI) specification.

4. The method of claim 1 , wherein the scanning is performed utilizing a device consisting of at least one of the following:

a non-volatile memory;

a volatile memory;

a locally stored file system; and

a network interface.

5. The method of claim 2 , wherein selecting by the processor a virus database includes:

selecting by the processor a subset of one or more virus databases from a plurality virus databases, said selected virus database being one of the subset of one or more virus databases; and

loading by the processor only the subset of one or more virus databases from the plurality of virus databases.

6. The method of claim 2 , wherein attempting by the processor to determine if the at least one scanned file is infected with a virus includes:

utilizing a virus signature that is included in the selected virus database.

7. The method of claim 6 , wherein attempting by the processor to determine if the at least one scanned file is infected with a virus includes:

utilizing by the processor a scanned file having a digital signature and contents;

checking by the processor that the digital signature of the scanned file having the digital signature and contents is valid;

attempting by the processor to determine if the contents of the scanned file having the digital signature and contents is infected with a virus; and

marking by the processor the scanned file having the digital signature and contents as being infected with a virus if a criteria is met;

wherein the criteria is chosen from a group consisting of:

the digital signature being invalid,

the contents of the scanned file appears to be infected with a virus, and

the digital signature being invalid and the contents of the scanned file appears to be infected with a virus.

8. The method of claim 7 , wherein the scanned file having a digital signature includes a digital signature in compliance with the Trusted Computing Platform Alliance (TCPA) specification.

9. The method of claim 1 , further including:

marking by the processor the at least one scanned file as being infected with a virus if a criteria is met; and

attempting by the processor to repair the at least one infected file before the at least one infected file is or are loaded into memory.

10. The method of claim 9 , wherein marking by the processor the at least one scanned file as being infected with a virus if a criteria is met includes:

utilizing by the processor a predefined set of criteria;

utilizing by the processor the selected virus database to determine if the at least one infected file is or are repairable; and

attempting by the processor to repair the at least one infected file before the at least one infected file is or are loaded into memory includes:

attempting by the processor to repair the at least one infected file only if the at least one infected file is or are repairable.

11. The method of claim 1 , further including:

resetting the system, by the processor, to enter the pre-boot phase.

12. The method of claim 1 , further comprising attempting by the processor to repair the at least one scanned file before the at least one scanned file is or are loaded into memory if the at least one scanned file is or are determined to be infected with a virus.

13. An apparatus comprising:

an operating system (OS) loader to load an OS and to load files into a memory during or after a boot phase of the apparatus and to, during a pre-boot phase, invoke a file system handler instead of the OS;

the file system handler to load, during the pre-boot phase, files stored within a file system of the Os; and

a pre-boot virus scanner, coupled to the OS loader and the file system handler, to scan files loaded by the file system handler, including attempting to determine if the scanned files are infected with a virus before attempting to store the scanned files into a memory and assigning a virus state to the scanned files based at least in part upon whether the at least one scanned file is or are infected with a virus

wherein, on completion of the scanning, the OS loader is to conditionally load the OS to transition the system into the boot phase, based at least in part on the results of the scanning by the pre-boot virus scanner.

14. The apparatus of claim 13 , wherein the pre-boot virus scanner is further capable of operating during a runtime phase of the apparatus following the boot phase.

15. The apparatus of claim 13 , further comprising a virus database to facilitate the identification of a virus; and wherein the pre-boot scanner is adapted to utilize the virus database to facilitate the identification of a virus infecting a file.

16. The apparatus of claim 15 , wherein the pre-boot virus scanner is capable of:

selecting the virus database from a plurality of virus databases.

17. The apparatus of claim 13 , wherein the file system handler is in compliance with the Extensible Firmware Interface (EFI) specification.

18. The apparatus of claim 13 , wherein the pre-boot virus scanner is capable of:

scanning a file having a digital signature and a contents;

checking the digital signature of the scanned file is valid;

attempting to determine if the contents of the scanned file is infected with a virus; and

marking the scanned file as being infected with a virus if a criteria is met;

wherein the criteria is chosen from a group consisting of:

the digital signature being invalid,

the contents of the scanned file appears to be infected with a virus, and

the digital signature being invalid and the contents of the scanned file appears to be infected with a virus.

19. The apparatus of claim 18 , wherein the scanned file having a digital signature includes a digital signature in compliance with the Trusted Computing Platform Alliance (TCPA) specification.

20. The apparatus of claim 13 , wherein the pre-boot virus scanner is capable of:

marking the scanned file as being infected with a virus if a criteria is met; and

attempting to repair the infected file before the infected file is loaded into memory.

21. An article, comprising:

a storage medium having a plurality of machine accessible instructions, wherein when the instructions are executed by a processor of a system having an operating system (OS) loader, a file system handler, and a pre-boot virus scanner, all operated by the processor, the instructions provide for:

during a pre-boot phase of the system, prior to a boot phase of the system,

invoking the OS loader to load an OS,

invoking, by the OS loader, the file system handler instead of the OS,

loading by the file system handler, files associated with a file system of the operating system,

scanning the files loaded by the file system handler by the pre-boot virus scanner, the scanning including,

attempting by the pre-boot virus scanner to determine if the scanned files are infected with a virus before attempting to store the scanned files into a memory, and

assigning by the pre-boot virus scanner a virus state to the scanned files based at least in part upon whether the at least one scanned file is or are infected with a virus, and

on completion of the scanning, conditionally loading the OS by the OS loader to transition the system into the boot phase, based at least in part on the results of the scanning by the pre-boot virus scanner.

22. The article of claim 21 , wherein the instructions further provide for:

selecting by the processor a subset of one or more virus databases from a plurality virus databases, said selected virus database being one of the subset of one or more virus databases; and

loading by the processor only the selected subset of one or more virus databases from the plurality of virus databases.

23. The article of claim 21 , wherein the file system handler is in compliance with the Extensible Firmware Interface (EFI) specification.

24. The article of claim 21 , wherein the instructions providing for attempting by the processor to determine if the at least one scanned file is or are infected with a virus includes instructions providing for

utilizing by the processor a virus signature that is included in a virus database.

25. The article of claim 24 , wherein the instructions providing for attempting by the processor to determine if the at least one scanned file is or are infected with a virus includes instructions providing for:

utilizing by the processor a scanned file having a digital signature and a contents;

checking by the processor that the digital signature of the scanned file having the digital signature and contents is valid;

attempting by the processor to determine if the contents of the scanned file having the digital signature and contents is infected with a virus; and

marking by the processor the scanned file having the digital signature and contents as being infected with a virus if a criteria is met;

wherein the criteria is chosen from a group consisting of:

the digital signature being invalid,

the contents of the scanned file appears to be infected with a virus, and

the digital signature being invalid and the contents of the scanned file appears to be infected with a virus.

26. The article of claim 25 , wherein the scanned file having a digital signature includes a digital signature in compliance with the Trusted Computing Platform Alliance (TCPA) specification.

27. The article of claim 21 , further including instructions providing for:

marking by the processor the at least one scanned file as being infected with a virus if a criteria is met; and

attempting by the processor to repair the at least one infected file before the at least one infected file is or are loaded into memory.

28. The article of claim 27 , wherein the instructions providing for marking by the processor the at least one scanned file as being infected with a virus if a criteria is met includes instructions providing for:

utilizing by the processor a predefined set of criteria;

utilizing by the processor a virus database to determine if the at least one infected file is or are repairable; and

attempting by the processor to repair the at least one infected file before the at least one infected file is or are loaded into memory includes:

attempting by the processor to repair the at least one infected file only if the at least one infected file is or are repairable.

29. The article of claim 21 , further including instructions providing for resetting the system by the processor to enter the pre-boot phase.