Augmenting system restore with malware detection

Patent metadata

Field	Value
Publication number	US-9613209-B2
Application number	US-201113334060-A
Country	US
Kind code	B2
Filing date	Dec 22, 2011
Priority date	Dec 22, 2011
Publication date	Apr 4, 2017
Grant date	Apr 4, 2017

Abstract

An anti-malware program monitors the behavior of a system after a system restore to determine the likelihood of a hidden infection of malicious code still existing after the system restore. The anti-malware program observes the dynamic behavior of the system by monitoring conditions that are likely to signify the possibility of an infection thereby necessitating the need to initiate anti-malware detection. The anti-malware program may observe the restoration history, system settings, malware infection history, to determine the likelihood of an existing hidden infection after a system restore.

First claim

What is claimed:

1. A computer-implemented method, comprising:
executing at least one system restore in a computing device, the system restore restoring a first set of resources stored in the computing device;
analyzing a plurality of conditions to determine if malware detection is needed during system restoration, the plurality of conditions including restoration history, system settings and infection history;
in response to determining that malware detection is needed, selecting a level of scanning from at least one of a deep scan level or a user scan level, wherein the deep scan level is selected when at least one of the plurality of conditions exceeds a threshold, wherein the user scan level is selected when none of the plurality of conditions exceeds a threshold; and
scanning, during the system restoration, a second set of resources that were not restored, at the selected level of scanning.

2. The computer-implemented method of claim 1 , wherein selecting the level of scanning is performed during the system restore.

3. The computer-implemented method of claim 1 , wherein selecting the level of scanning further comprises:
setting the user scan level if a number of previously-executed restore operations does not meet a threshold.

4. The computer-implemented method of claim 1 , wherein selecting the level of scanning further comprises:
setting the deep scan level if a number of previously-executed restore operations exceeds a threshold.

5. The computer-implemented method of claim 1 , wherein selecting the level of scanning further comprises:
setting the deep scan level when a critical system setting is not enabled.

6. The computer-implemented method of claim 1 , wherein selecting the level of scanning further comprises:
setting the user scan level when a non-critical system setting is not enabled for at least a threshold amount of non-critical system settings.

7. The computer-implemented method of claim 1 , wherein selecting the level of scanning further comprises:
setting the deep scan level when a number of previous infections exceeds a threshold.

8. The computer-implemented method of claim 1 , wherein selecting the level of scanning further comprises:
contacting an application store for data pertaining to previously obtained applications downloaded to the computing device; and
setting the deep scan level when a known malware program was previously downloaded to the computing device.

9. A device, comprising:
at least one processor and a memory; the at least one processor configured to:
perform a system restoration onto the device, the system restoration restoring a first set of resources stored on the device;
analyze, during the system restoration, for occurrence of a plurality of system conditions, the plurality of system conditions including restoration history, system settings, and infection history;
determine whether malware detection is warranted during the system restoration based on the occurrence of one or more of the plurality of system conditions; and
perform, during the system restoration, a level of malware detection based on the occurrence of the one or more of the plurality of system conditions on a second set of resources that were not restored, the level of malware detection selected from at least one of a deep scan level or a user scan level, wherein the deep scan level is selected when at least one of the plurality of conditions exceeds a threshold, wherein the user scan level is selected when none of the plurality of conditions exceeds a threshold.

10. The device of claim 9 , wherein the at least one processor is further configured to:
utilize critical settings associated with an operating system to determine whether malware detection is warranted.

11. The device of claim 9 , wherein the system settings include one or more of: operating system update settings, firewall settings, browser settings, malware dictionary update settings, and user access control settings.

12. The device of claim 9 , wherein determine whether malware detection is warranted during the system restoration based on the occurrence of one or more of the plurality of system conditions further comprises analyzing whether the occurrence of the one or more of the plurality of system conditions meets a specific threshold.

13. A system, comprising:
a memory including an operating system; and
at least one processor programmed to:
restore one or more files of the operating system while at least one resource of the system is not restored;
analyze, during the restore, a plurality of conditions to determine whether malware detection is warranted, the plurality of conditions indicating restoration history, system settings, and infection history;
determine a level of malware detection, the level of malware detection selected from at least one of a deep scan level or a user scan level, wherein the deep scan level is selected when at least one of the plurality of conditions exceeds a threshold, wherein the user scan level is selected when none of the plurality of conditions exceeds a threshold; and

apply, during the restore, the level of malware detection to at least one resource of the system that was not restored.

14. The system of claim 13 , wherein the deep scan level is selected when a critical system setting is not enabled.

15. The system of claim 13 , wherein the system settings include one or more of: operating system update settings, firewall settings, browser settings, malware dictionary update settings, and user access control settings.

16. The system of claim 15 , wherein the at least one processor is further configured to set a deep scan level when a number of system settings that are disabled exceeds a threshold.

17. The system of claim 13 , wherein the deep scan level is selected when a known malware program was previously downloaded.

18. The system of claim 13 , wherein the at least one processor is further programmed to:
utilize information provided by an application store to determine whether malware detection is warranted.

Assignees

• Kapoor Vishal
• Joyce Jason
• Nichols Gregory
• Microsoft Technology Licensing Llc

Inventors

• Kapoor Vishal
• Joyce Jason
• Nichols Gregory

Classifications

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title