Back to the Future: A Framework for Automatic Malware Removal and System Repair

Malware is software with malicious intent. Besides viruses and worms, spyware, adware, and other newer forms of malware have recently emerged as widely-spread threats to system security. It is difficult to detect malware reliably because new and polymorphic ones appear frequently. It is also difficult to remove malware and repair its damage to the system because some malware programs can extensively modify a system. We propose a novel framework for automatically removing malware and repairing its damage to a system. The primary goal of our framework is to preserve system integrity. Our framework monitors and logs untrusted programs’ operations. Using these logs, it can completely remove malware programs and their effects on the system, and reliably restore the infected data. Our framework does not require signatures or other prior knowledge of malware behavior. We implemented this framework on Windows and evaluated it with seven spyware, trojan horses, and email worms. Comparing ou...

• Type: Conference
• Year: 2006
• Where: ACSAC
• Authors: Francis Hsu, Hao Chen, Thomas Ristenpart, Jason Li, Zhendong Su
• Keywords: ACSAC 2006, Malware, Malware Behavior, Malware Programs, Security Privacy