Malware removal method and system, and computer storage medium

Patent metadata

Field	Value
Publication number	US-9910989-B2
Application number	US-201414560717-A
Country	US
Kind code	B2
Filing date	Dec 4, 2014
Priority date	Jun 7, 2012
Publication date	Mar 6, 2018
Grant date	Mar 6, 2018

Abstract

A method, device, and a computer storage medium are provided. The method includes: starting a core file and building an environment after running an operation system, then loading a driver in the built environment; reading a configuration file by the driver to obtain a path of a malware; and deleting a registry and file of the malware in a kernel layer according to the path. The device includes: a start loading module configured to start a core file and build an environment after running an operation system, then load a driver in the built environment; a path reading module configured to calculate a configuration file by the driver to obtain a path of a malware; and a program deleting module configured to delete a registry and file of the malware in a kernel layer according to the path.

First claim

What is claimed is:

1. The method of removing malware in a computer that executes an operating system, the method comprising:
during start up of the operating system, starting a core file and building a kernel driver environment in a kernel layer for same operating system, and loading a driver in the built kernel driver environment before completion of registry and file systems initialization;
reading, by the driver in the kernel layer, a configuration file to obtain a registry and file path of a malware; and
deleting, by the driver in the kernel layer before the completion of registry and file systems initialization, a registry and file of the malware according to the obtained registry and file path of the malware,
in response to the deleting being unsuccessful,
reading by the driver in the kernel layer to obtain the registry path of the malware, when the operating system shutting down and releasing the registry system for the operating system; and
calling a registry uninstall function to delete the registry of the malware according to the registry path of the malware.

2. The method according to claim 1 , wherein the deleting, by the driver in the kernel layer before the completion of registry and file systems initialization, the registry and file of the malware, comprises:
deleting the registry and file of the malware via the driver run in the kernel layer utilizing a force deleting file interface of the kernel layer.

3. The method according to claim 1 , wherein the reading, by the driver in the kernel layer, the configuration file comprises:
traversing the configuration file to obtain the registry path and the file path of the malware, respectively.

4. The method according to claim 1 , further comprising:
reading by the driver in the kernel layer to obtain the file path of the malware, when the operating system shutting down and releasing the file system for the operating system; and
calling a file uninstall function to delete the file of the malware according to the file path of the malware.

5. The method according to claim 4 , wherein prior to the calling the registry uninstall function to delete the registry of the malware according to the registry path of the malware, the method further comprises:
pre-registering the registry uninstall function;
prior to the calling a file uninstall function to delete the file of the malware according to the file path of the malware, the method further comprises:
pre-registering the file uninstall function.

6. A malware removal device comprising:
non-transitory computer readable storage medium to store registry(ies), files and program(s), and
computer hardware configured, including configured by the program(s), to implement modules to:
during start up of an operating system program, start a core file and build kernel driver environment in a kernel layer for same operating system, and load a driver in the built kernel driver environment before completion of registry and file systems initialization;
read, by the driver in the kernel layer, a configuration file to obtain a registry and file path of a malware;
perform a deletion, by the driver in the kernel layer before the completion of registry and file systems initialization, of a registry and file of the malware according to the obtained registry and file path of the malware; and
in response to the deletion being unsuccessful,
read by the driver in the kernel layer to obtain the registry path of the malware, when the operating system shutting down and releasing the registry system for the operating system; and
call a registry uninstall function to delete the registry of the malware according to the registry path of the malware.

7. The malware removal device according to claim 6 , wherein the deletion, by the driver in the kernel layer before the completion of registry and file systems initialization, deletes the registry and file of the malware via the driver run in the kernel layer by utilizing a force deleting file interface of the kernel layer.

8. The malware removal device according to claim 6 , wherein the reading the configuration file traverses the configuration file via the driver, to obtain the registry path and the file path of the malware, respectively.

9. The malware removal device according to claim 6 , the computer hardware configuration further implements modules to:
read by the driver in the kernel layer to obtain the file path of the malware, when the operating system shutting down and releasing the file system for the operating system; and
call a file uninstall function to delete the file of the malware according to the file path of the malware.

10. The malware removal device according to claim 9 , the computer hardware configuration further implements modules to:
pre-register the registry uninstall function and pre-register the file uninstall function.

11. A non-transitory computer storage medium for storing computer-executable instructions used for controlling a method of removing malware in a computer that executes an operating system, wherein the method comprises:
during start up of the operating system, starting a core file and building a kernel driver environment in a kernel layer for same operating system, and loading a driver in the built kernel driver environment before completion of registry and file systems initialization;
reading, by the driver in the kernel layer, a configuration file to obtain a registry and file path of a malware;
deleting, by the driver in the kernel layer before the completion of registry and file systems initialization, a registry and file of the malware according to the obtained registry and file path of the malware; and
in response to the deleting being unsuccessful, while the operating system shuts down and releases the registry system for the operating system, calling a registry uninstall function to control a deletion of a registry of the malware according to the registry path of the malware.

Assignees

• Tencent Tech Shenzhen Co Ltd
• Tencent Tech Shenzhen Co Ltd

Inventors

• Yu Xiao

Classifications

• G06F21/568 Primary

  eliminating virus, restoring damaged files · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title