Protecting user mode processes from improper tampering or termination
In one embodiment, a malware protection system may protect a computing system from a malware event. A data storage device 150 may store a watchdog filter driver 240 integrated with an operating system kernel 210 . A processor 120 may intercept a process access to an application process 220 with the watchdog filter driver 240 to detect a malware event. The processor 120 may use the watchdog filter driver 240 to determine an originating process for the malware event.
1. A machine-implemented method for malware protection of a computing device, comprising:
executing a watchdog filter driver integrated with an operating system kernel;
intercepting an open handle request to an application process with the watchdog filter driver to detect a malware event;
determining with the watchdog filter driver an originating process for the malware event;
filtering an open handle to remove a process access for the originating process; and
detecting if the application process terminates.
2. The method of claim 1 , further comprising:
monitoring a system registry with the watchdog filter driver to detect a malware registry attack.
3. The method of claim 1 , further comprising:
monitoring a file system with the watchdog filter driver to detect a malware file attack.
4. The method of claim 1 , further comprising:
preventing a successful malware process attack with the watchdog filter driver.
5. The method of claim 1 , further comprising:
detecting a callback invoked by a resource manager for the application process; and
checking a monitored process list for the application process.
6. The method of claim 1 , further comprising:
setting a minimum administrative privilege level for disabling the watchdog filter driver.
7. The method of claim 1 , further comprising:
relaunching the application process using a watchdog service upon termination of the application process.
8. The method of claim 1 , further comprising:
relaunching the application process using a user relaunch shell extension upon termination of the application process.
9. The method of claim 8 , wherein the user relaunch shell extension is an icon-type shell extension.
10. A tangible machine-readable storage medium having a set of instructions detailing a method stored thereon that when executed by one or more processors cause the one or more processors to perform the method, the method comprising:
intercepting an open handle request to an application process with a watchdog filter driver to detect a malware event;
determining an originating process for the malware event with the watchdog filter;
filtering an open handle to remove a process access for the originating process; and
detecting if the application process terminates.
11. The tangible machine-readable storage medium of claim 10 , wherein the watchdog filter driver is integrated with the operating system kernel.
12. The tangible machine-readable storage medium of claim 10 , wherein the method further comprises:
monitoring a system registry with the watchdog filter driver to detect a registry attack.
13. The tangible machine-readable storage medium of claim 10 , wherein the method further comprises:
monitoring a file system with the watchdog filter driver to detect a file attack.
14. The tangible machine-readable storage medium of claim 10 , wherein the method further comprises:
preventing the malware event with the watchdog filter driver.
15. The tangible machine-readable storage medium of claim 10 , wherein the method further comprising:
relaunching the application process using a watchdog service upon termination of the application process.
16. The tangible machine-readable storage medium of claim 10 , wherein the method further comprising:
relaunching the application process using a user relaunch shell extension upon termination of the application process.
17. A malware protection system for a computing device, comprising:
a data storage device to store a watchdog filter driver integrated with an operating system kernel; and
a processor to intercept an open handle request to an application process with the watchdog filter driver to detect a malware event, determine an originating process for the malware event with the watchdog filter driver, filtering an open handle to remove a process access for the originating process; and detects if the application process terminates.
18. The malware protection system of claim 17 , wherein the watchdog filter driver prevents the malware event.
19. The malware protection system of claim 17 , wherein the watchdog filter driver implements a watchdog service to relaunch the application process upon termination of the application process.
20. The malware protection system of claim 17 , wherein the watchdog filter driver monitors a system registry to detect a malware registry attack.