System and method for protecting against wipers by delaying suspicious actions

Abstract

A device and method are provided for protecting against malware attacks affecting a computer system. To do so, system operations are detected and categorized as benign, suspicious, or malicious. Suspicious actions are delayed and placed in a queue instead of being immediately executed. The process initiating the suspicious action is determined and the suspicious action is categorized as benign or malicious based on the initiating process. When the suspicious action is categorized as a benign action, the suspicious action is performed. Conversely, when the suspicious action is categorized as a malicious action, the suspicious process is terminated, and the malicious action is removed from the unperformed actions queue without performing the malicious action.