The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Dec. 23, 2014

Filed:

May. 14, 2012
Applicants:

Yuefeng LI, Nanjiang, CN;

Hongbo Gan, Nanjiang, CN;

Hua YE, Nanjiang, CN;

Inventors:

Yuefeng Li, Nanjiang, CN;

Hongbo Gan, Nanjiang, CN;

Hua Ye, Nanjiang, CN;

Assignee:

Trend Micro Inc., Tokyo, JP;

Attorney:
Primary Examiner:
Assistant Examiner:
Int. Cl.
CPC ...
G06F 21/00 (2013.01); G06F 9/00 (2006.01); G06F 12/14 (2006.01); G06F 21/57 (2013.01); G06F 21/56 (2013.01);
U.S. Cl.
CPC ...
G06F 21/575 (2013.01); G06F 21/568 (2013.01);
Abstract

During a bootstrapping process, path names of necessary bootstrap modules are collected and stored into a file. When an infected bootstrap component is detected, the method initiates emulation of the bootstrapping process within a virtual machine rather than directly cleaning malware from the infected bootstrap component. A settings file is copied into the virtual machine indicating the necessary bootstrap components in the host computer (including the infected component). Alternatively, the actual components are copied into the virtual machine. A clean version of the infected bootstrap component is made available to the virtual machine. The virtual machine is launched using the bootstrap components (including the clean version of the infected bootstrap component) and it emulates the bootstrapping process of the operating system. A successful bootstrap indicates the infected bootstrap component may be cleaned on the host computer. An unsuccessful bootstrap indicates the infected bootstrap component should not be cleaned of malware.


Find Patent Forward Citations

Loading…