Patent ID: 8495741
Filing Date: 2013-07-23
Classification: G06F

Abstract:
1. A method for remediating an infection of malware on a storage device of a computer, the malware using a rootkit technique to protect itself, comprising: locating data on the storage device associated with the malware; storing encrypted information describing the location of the data associated with the malware on the storage device of the computer in a registry maintained by an operating system of the computer; configuring the computer to execute an executable file adapted to obfuscate the data associated with the malware upon boot; booting the computer responsive to configuring the computer, the booting causing the executable file to execute and use the stored information to: determine whether the data associated with the malware are previously obfuscated; and if the data associated with the malware are not previously obfuscated, obfuscate the data associated with the malware to prevent the malware from executing by altering the data associated with the malware using a reversible technique and storing obfuscation data enabling reversal of the alteration to an alternate stream of the executable file; and remediating the infection of malware responsive to the obfuscation.