Patent ID: 8943595
Filing Date: 2015-01-27
Classification: G06F

Abstract:
1. A method for managing malware comprising: identifying, by a computer system, a group of files for an application installed on the computer system in response to a request to scan the application for the malware; determining, by the computer system, whether the application installed on the computer system has a package in a catalog of a manager; responsive to the computer system determining that the application installed on the computer system does have the package in the catalog of the manager, determining, by the computer system, whether a block in the package contains a reference to a remote file that is retrieved at installation of the application; responsive to the computer system determining that the block contains the reference to the remote file that is retrieved at the installation of the application, uninstalling, by the computer system, the application installed on the computer system; generating, by the computer system, a first image of the group of files for the application not installed on the computer system; reinstalling, by the computer system, the application on the computer system; generating, by the computer system, a second image of the group of files for the application reinstalled on the computer system; comparing, by the computer system, the first image and the second image of the group of files for the application to form a comparison; determining, by the computer system, a number of differences between the first image and the second image of the group of files for the application based on the comparison; including, by the computer system, the number of differences between the first image and the second image of the group of files for the application in a second package that is valid only for the request to scan the application for the malware; parsing, by the computer system, a number of blocks in the second package; responsive to the computer system parsing the number of blocks in the second package, forming, by the computer system, a list of files for the application; selecting, by the computer system, a number of files from the list of files; generating, by the computer system, a descriptor identifying the number of files selected from the list of files; placing, by the computer system, a command to perform the scan for the malware in the descriptor identifying the number of files; sending, by the computer system, the descriptor with the command to perform the scan for the malware to a scanner; scanning, by the computer system, the number of files for the application for the malware using the scanner to obtain a report corresponding to the scan; modifying, by the computer system, a block format in the computer system by adding a number of new stanzas containing a map between a file name and an application module name; and responsive to the computer system identifying in the report a file in the number of files for the application as infected with the malware, downgrading, by the computer system, the application by removing only a specific module that uses the file infected with the malware from the application without impacting other functionalities of the application, wherein the application module name of the specific module is mapped to the file name of the file infected with the malware by a stanza in the number of new stanzas in the modified block format in the computer system.