Patent ID: 7472420
Filing Date: 2008-12-30
Classification: G06F

Abstract:
1. A method for identifying malware components on a computer, the method comprising: (a) detecting an attempt by a process to create or modify an executable file or an attempt to write to a system registry; (b) logging the attempt as an auditable event; (c) performing a malware check on executable files of the computer, (d) if malware is detected on the computer, identifying all other files created or modified by the process of step (a), and all other processes related to the auditable event, including processes having a parent-child relationship to the process of step (a), in both up and down directions of the parent-child tree, including processes that are other children of the processes in the parent-child tree, including files created or modified by processes that belong the parent-child tree of the process of step (a), and including processes launched from those files; (e) terminating the processes related to the auditable event; (f) deleting or quarantining the executable files identified in step (d); and (g) for any deleted executable system files, restoring the system files from a trusted backup.