Patent ID: 8615805

Claim:
A method for classifying a process that disables a registry attribute, the method comprising: monitoring, by a hardware processor, at least one attribute of a registry that relates to a setting of an operating system, wherein the at least one attribute of the registry is selected from the group comprising at least one of: a registry edit attribute, a task manager attribute, a firewall attribute, or an automatic update attribute; determining, by the hardware processor, that the at least one attribute of the registry has been disabled; identifying, by the hardware processor, the process that disabled the at least one attribute; evaluating, by the hardware processor, one or more characteristics of the identified process, wherein the one or more characteristics comprise an indicator to confirm that the identified process disabled the at least one attribute of the registry; and classifying, by the hardware processor, the identified process based on the evaluation of the one or more characteristics of the identified process.