Trend Micro Inc.

Mingyan Sun

Chi-Huang Fan

Zhihe Zhang

Zhengmao Lin

A computing device is capable of automatically detecting malware execution and cleaning the effects of malware execution using a malware repair module that is customized to the operating features and characteristics of the computing device. The computing device has software modules, hardware components, and network interfaces for accessing remote sources which, collectively, enable the device to restore itself after malware has executed on it. These modules, components, and interfaces may also enable the apparatus to delete the malware, if not entirely, at least partially so that it can no longer execute and cause further harm. The malware repair module is created from a detailed malware behavior data set retrieved from a remote malware behavior database and then modified to take into account specific operating features of the computing device. The repair module executes on a repair module execution engine and the effects of the malware on the device are minimized.

Automatic generation of malware clean pattern

Applications running in an API-proxy-based emulator are prevented from infecting a PC's hard disk when executing file I/O commands. Such commands are redirected to an I/O redirection engine instead of going directly to the PC's normal operating system where it can potentially harm files in on the hard disk. The redirection engine executes the file I/O command using a private storage area in the hard disk that is not accessible by the PC's normal operating system. If a file that is the subject of a file I/O command from an emulated application is not in the private storage area, a copy is made from the original that is presumed to exist in the public storage area. This copy is then acted on by the command and is stored in the private storage area, which can be described as a controlled, quarantined storage space on the hard disk. In this manner the PC's (or any computing device's) hard disk is defended from potential malware that may originate from applications running in emulated environments.

Growing community of inventors

Beijing, China

Mingyan Sun