Patent ID: 8234710

Claim:
A method for removing malware from a target computer, which normally boots into a normal shell under management of a normal operating system (OS), and provides a normal OS environment in which a plurality of environment variables are arranged in a normal OS arrangement within tangible digital storage, the method comprising: a) booting the target computer from tangible digital storage into a diagnostic OS, the diagnostic OS automatically: (i) installing in tangible digital storage a diagnostic OS environment, which provides an arrangement of the plurality of environment variables that differs from the normal OS arrangement; (ii) initiating, within the diagnostic OS, using instructions stored in tangible digital storage, a malware removal coordinating program causing the target computer to automatically perform the steps of: (A) accessing from tangible digital storage a plurality of malware removal applications, (B) initiating execution of each of the plurality of malware removal applications, including a given malware removal application that executes variable-accessing logic, the variable-accessing logic relying upon the arrangement of the plurality of environment variables in the normal OS environment, to find the value of a particular environment variable, and (C) redirecting the given malware removal application to a correct value, corresponding to the normal OS environment, of the particular environment variable, without modifying the variable-accessing logic of the given malware removal application, wherein redirecting the given malware removal application occurs upon an attempt by the given malware removal application to access a registry variable; and (iii) rebooting the target computer into the normal shell in the normal OS, wherein an environment variable is a variable that contains operating system configuration information, operating system options, or information related to controlling the behavior of a process.