Offline scan, clean and telemetry using installed antimalware protection components

Patent metadata

Field	Value
Publication number	US-9767282-B2
Application number	US-96759610-A
Country	US
Kind code	B2
Filing date	Dec 14, 2010
Priority date	Dec 14, 2010
Publication date	Sep 19, 2017
Grant date	Sep 19, 2017

Abstract

The subject disclosure relates to antimalware scanning, and more particularly to offline antimalware scanning of a host environment via an alternate, known safe operating system. An offline scanning product obtains data previously written by the host environment online antimalware scanning tool, e.g., configuration data and antimalware signatures in shared data stores accessible to the offline and online products, and uses that data to perform the offline antimalware scan. The offline scanning product writes results information and any quarantined files to other shared data stores, whereby the online environment, when rebooted, has access to the information, such as for review and to upload telemetry information to an online service for analysis. Also described is offline replacement of operating system files that cannot be cleaned or removed when online.

First claim

What is claimed is:

1. In a computing environment, a method performed at least in part on at least one processor, comprising:
running an offline antimalware product in an offline environment in which a host operating system is not running; and
within the offline environment in which the host operating system is not running:
reading data related to an antimalware scan from a storage location into the offline environment, including data that was previously persisted by an online antimalware product when the host operating system was previously running;
performing offline scanning of a set of files that correspond to files accessible via the host operating system environment;
writing information related to results of the offline scanning into one or more other storage locations that are accessible to an online program when the host operating system is later running;
signaling the online antimalware product, when the host operating system is later running, that the offline scanning of the set of files was performed; and
replacing one or more pre-determined files of the set of files, which cannot be cleaned or removed, by known non-infected file.

2. The method of claim 1 wherein reading the data related to an antimalware scan into the offline environment comprises reading settings data.

3. The method of claim 1 wherein reading the data related to an antimalware scan into the offline environment comprises reading configuration data.

4. The method of claim 3 wherein reading the data comprises obtaining a location of at least one other storage location corresponding to a signature store, a quarantine store, a results store, or a history store, or any combination of the signature store, the quarantine store, the results store, or the history store.

5. The method of claim 3 wherein reading the data within the offline environment comprises obtaining a location of a signature store associated with the online antimalware product, and further comprising, loading antimalware signatures from the signature store.

6. The method of claim 5 further comprising, verifying integrity of the antimalware signatures.

7. The method of claim 1 wherein writing the information related to the results comprises writing scanning-related history information or scanning-related telemetry information, or both scanning-related history information and scanning-related telemetry information, into the one or more other storage locations.

8. The method of claim 1 wherein writing the information related to the results comprises writing scanning-related telemetry information into the one or more other storage locations, and further comprising, uploading the telemetry information to a security service.

9. The method of claim 1 further comprising, quarantining a file, including writing a copy of the file to a storage location that is accessible to an online program when the host operating system is later running.

10. The method of claim 1 wherein writing the information related to the results comprises writing scanning-related history information into the one or more other storage locations, and further comprising, merging the history information with other history information maintained from at least one previous scan, including a scan previously performed by the online antimalware product.

11. The method of claim 1 wherein writing the information related to the results comprises writing data that indicates that the offline scan was performed to a storage location that is accessible to an online program when the host operating system is later running.

12. In a computing environment, a system comprising:
a processor programmed to execute an offline antimalware product configured to operate in an offline environment, including when a host operating system is not running, in which the offline antimalware product operates in the offline environment to:
read scanning-related data provided by an online program when that online program was previously running on the host operating system;
scan a set of files corresponding to files accessed via the host operating system environment;
signal an online antimalware product, when the host operating system is later running, that the scanning of the set of files was performed;
perform remediation on one or more of the set of files that are detected as infected with malware; and
replace at least one pre-determined file of the set of files, which cannot be cleaned or removed while performing remediation, by a known non-infected copy of the at least one pre-determined file.

13. The system of claim 12 wherein the scanning-related data comprises configuration and settings data maintained in a configuration and settings data store in the offline environment's program space.

14. The system of claim 13 wherein the scanning-related data further comprises antimalware signature data maintained in an antimalware signature data store in the offline environment's program space.

15. The system of claim 12 wherein the offline antimalware product performs remediation by quarantining an infected file to a data store that is accessible to a program running on the host operating system, including being accessible for restoring or deleting that file, when that host operating system is later running.

16. The system of claim 12 wherein the offline antimalware product is further configured to write scanning-related results information to a data store that is accessible to a program running on the host operating system when that host operating system is later running.

17. The system of claim 12 wherein the offline antimalware product is further configured to restore an operating system file.

18. One or more computer storage devices having computer-executable instructions, which when executed perform steps, comprising:
downloading antimalware signatures to a data store via a program that runs on a host operating system;
halting operation of the host operating system by booting a computer system on which the host operating system runs into an offline computing environment;
running an antimalware product in the offline computing environment, including accessing the antimalware signatures, scanning a set of files corresponding to files that are accessible via the host operating system to detect malware based on the antimalware signatures, and performing remediation on at least one file in which malware was detected;
writing results information to a storage location that is accessible to a program running on the host operating system when that host operating system is later running;
signaling an online antimalware product, when the host operating system is later running, that an offline scanning of the set of files was performed; and
in the offline computing environment, replacing the at least one predetermined file that cannot be cleaned or removed with a corresponding non-infected file.

19. The one or more computer storage devices of claim 18 having further computer-executable instructions comprising, uploading, via the program running on the host operating system when that host operating system is later running, at least some of the results information to a remote security service.

20. The one or more computer storage devices of claim 18 wherein writing results information comprises writing data that indicates that the offline scan was performed to a storage location that is accessible to an online program when the host operating system is later running.

Assignees

• Reasor Sterling M
• Hilwa Kumi N
• Hsia Eddy S
• Chakraborty Santanu
• Faulhaber Joseph Leo
• Kapoor Vishal
• Jarrett Michael Sean
• Turner Charles
• Croy Jeremy D
• Microsoft Technology Licensing Llc

Inventors

• Reasor Sterling M
• Hilwa Kumi N
• Hsia Eddy S
• Chakraborty Santanu
• Faulhaber Joseph Leo
• Kapoor Vishal
• Jarrett Michael Sean
• Turner Charles
• Croy Jeremy D

Classifications

• G06F21/565

  by checking file integrity · CPC title

• G06F21/564 Primary

  by virus signature recognition · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title