Method and system for detecting malware using a remote server
The present disclosure is directed to a method and system for detecting malware using a remote server. In accordance with a particular embodiment of the present disclosure a hash value for a file is generated. The hash value is transmitted to a remote server. A notification is received from the remote server indicating whether the file comprises malware. At least one operation on the file is prevented if the notification indicates the file comprises malware.
1. A method for detecting malware, comprising:
determining, by a malware scanner on a client, that one or more bytes within a header of a non-executable file stored on the client have changed and caused the non-executable file to change into an executable file;
in response to determining that the non-executable file has changed into the executable file:
generating a hash value for a file;
transmitting the hash value to a remote server;
receiving a notification from the remote server indicating whether the file comprises malware; and
preventing at least one operation on the file if the notification indicates the file comprises the malware.
2. The method of claim 1 , further comprising detecting, at the remote server, whether the file comprises the malware by comparing the hash value to one or more permitted files.
3. The method of claim 1 , wherein preventing at least one operation on the file if the notification indicates the file comprises the malware comprises encrypting the file.
4. The method of claim 1 , wherein preventing at least one operation on the file if the notification indicates the file comprises the malware comprises deleting the file.
5. The method of claim 1 , further comprising generating an advisory message for a user that indicates the file comprises the malware in response to receiving the notification from the remote server indicating that the file comprises the malware.
6. The method of claim 1 , further comprising allowing at least one operation on the file if the file does not comprise the malware.
7. A system for detecting malware, comprising:
a storage device; and
a processor, the processor operable to execute a program of instructions operable to:
determine that one or more bytes within a header of a non-executable file stored on the client have changed and caused the non-executable file to change into an executable file;
in response to determining that the non-executable file has changed into the executable file:
generate a hash value for a file;
transmit the hash value to a remote server;
receive a notification from the remote server indicating whether the file comprises malware; and
prevent at least one operation on the file if the notification indicates the file comprises malware.
8. The system of claim 7 , wherein the program of instructions is further operable to detect whether the file comprises the malware by comparing the hash value to one or more permitted files.
9. The system of claim 7 , wherein the program of instructions is further operable to encrypt the file.
10. The system of claim 7 , wherein the program of instructions is further operable to delete the file.
11. The system of claim 7 , wherein the program of instructions is further operable to generate an advisory message for a user that indicates the file comprises the malware, the advisory message generated in response to receiving the notification from the remote server indicating that the file comprises the malware.
12. The system of claim 7 , wherein the program of instructions is further operable to allow at least one operation on the file if the file does not comprise the malware.
13. Logic encoded in non-transitory media, the logic being operable, when executed on a processor, to:
determine that one or more bytes within a header of a non-executable file stored on the client have changed and caused the non-executable file to change into an executable file;
in response to determining that the non-executable file has changed into the executable file:
generate a hash value for a file;
transmit the hash value to a remote server;
receive a notification from the remote server indicating whether the file comprises malware; and
prevent at least one operation on the file if the notification indicates the file comprises malware.
14. The logic of claim 13 , wherein the logic is further operable to detect whether the file comprises the malware by comparing the hash value to one or more permitted files.
15. The logic of claim 13 , wherein the logic is further operable to encrypt the file.
16. The logic of claim 13 , wherein the logic is further operable to delete the file.
17. The logic of claim 13 , wherein the logic is further operable to generate an advisory message for a user that indicates the file comprises the malware in response to receiving the notification from the remote server indicating that the file comprises the malware.
18. The logic of claim 13 , wherein:
the notification from the remote server indicates that the file comprises malware; and
the logic is further operable when executed to restore the executable file back to the non-executable file.
19. The method of claim 13 , wherein the notification from the remote server indicates that the file comprises malware, and the method further comprises:
restoring the executable file back to the non-executable file.
20. The system of claim 7 , wherein:
the notification from the remote server indicates that the file comprises malware; and
the processor is further operable to restore the executable file back to the non-executable file.