CN101046752A - 在病毒攻击时引导备选mbr的系统和方法 - Google Patents

在病毒攻击时引导备选mbr的系统和方法 Download PDF

Info

Publication number
CN101046752A
CN101046752A CNA2007100913058A CN200710091305A CN101046752A CN 101046752 A CN101046752 A CN 101046752A CN A2007100913058 A CNA2007100913058 A CN A2007100913058A CN 200710091305 A CN200710091305 A CN 200710091305A CN 101046752 A CN101046752 A CN 101046752A
Authority
CN
China
Prior art keywords
boot record
main boot
service
current
mbr
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CNA2007100913058A
Other languages
English (en)
Inventor
菲利普·李·查尔德斯
迈克·查尔斯·戴维斯
斯蒂文·代尔·顾德曼
约瑟夫·韦恩·弗瑞曼
兰德尔·斯科特·斯普林菲尔
罗德·戴维·沃特曼
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Lenovo Singapore Pte Ltd
Original Assignee
Lenovo Singapore Pte Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Lenovo Singapore Pte Ltd filed Critical Lenovo Singapore Pte Ltd
Publication of CN101046752A publication Critical patent/CN101046752A/zh
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1402—Saving, restoring, recovering or retrying
    • G06F11/1415—Saving, restoring, recovering or retrying at system level
    • G06F11/1417—Boot up procedures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/1666—Error detection or correction of the data by redundancy in hardware where the redundant component is memory or memory area

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Quality & Reliability (AREA)
  • Storage Device Security (AREA)
  • Stored Programmes (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

在硬盘驱动器上的被病毒感染的MBR可能阻止引导的情况下，可以使用隐藏受保护区域中的服务MBR引导服务O.S.，然后可以使用同样也是在隐藏受保护区域中的先前备份的MBR替代服务MBR，来安装任何缺少的分区。

Description

在病毒攻击时引导备选MBR的系统和方法
技术领域
本发明总体上涉及引导计算机中的操作系统。
背景技术
当打开计算机时，调用存储在计算机非易失性固态存储器中的例如基本输入输出系统(BIOS)的引导装入程序，从而开始“引导”过程，其中进行各种初始化的工作。在这些初始化工作中最重要的是将操作系统从计算机的磁盘存储器上复制到通常是计算机的易失性固态存储器上，用于当使用计算机时计算机的处理器执行操作系统。当关闭计算机或当计算机“重引导”时，存储器中的操作系统被刷新。通过从相对快的存储器而不是从磁盘上执行操作系统，加速了计算机操作。
引导中基本的工具是主引导记录(MBR)，通常在引导过程早期BIOS从辅助存储器访问MBR。在当前实施中，MBR可以存储在硬盘驱动器的前63个扇区，分区引导记录(PBR)存储在后续磁盘扇区中。MBR包含BIOS必须知道从而完成引导的各种O.S.数据的磁盘位置记录，包括包含磁盘上数据分布的分区表。分区表可以具有例如4个分区的空间，每个条目包括分区大小、分区是引导分区时的标记符、以及定义文件系统的类型。
本发明认识到可能设计了恶意的病毒将磁盘的前63个扇区清空或者毁坏MBR从而阻止引导。本发明进一步认识到虽然能够将MBR备份到外部存储器中，但恢复MBR需要定位外部存储器和从外部存储器下载信息，这需要时间，并进一步取决于用户记得备份MBR的频率，外部存储的拷贝可能会过时。考虑到上述关键性的认识，由此提供本发明。
发明内容
计算机介质存储逻辑，该逻辑包括接收引导中断信号、作为响应使用服务主引导记录(MBR)覆盖当前MBR。服务MBR用于引导服务操作系统，然后由先前备份的MBR替代。
如果需要，在有的实施中，逻辑能够包括当使用服务MBR时访问先前备份的MBR从而安装任何没有安装的分区。服务MBR和先前备分的MBR可以存储在辅助存储器中的隐藏分区区域(HPA)中。
在非限制实施中，逻辑能够包括在用服务MBR覆盖当前MBR之前，备份当前MBR。只有首先确定MBR备份表有效时才备份当前MBR。同时，只有首先确定服务MBR有效时才用服务MBR覆盖当前MBR。
在下面描述的有的实施中，先前备份的MBR可以是多个先前备份的MBR之一，先前备份的MBR存储在辅助存储器的HPA中。当前主引导记录通过以当前主引导记录覆盖先前备份的主引导记录中最早的一个而变化时，备份当前主引导记录。当前主引导记录中的分区表变化时，可以例如修改服务主引导记录。
另一方面，计算机系统包括例如但不限于BIOS的引导装入程序、例如但不限于硬盘驱动器的辅助存储器，其存储用户操作系统(UOS)和服务操作系统(SOS)。能够提供主存储器，引导装入程序通过接入当前主引导记录(MBR)将操作系统从辅助存储器装入主存储器从而执行引导序列。引导装入程序响应于引导中断信号，使用存储器辅助存储器中的服务MBR替代当前MBR，装入SOS，使用辅助存储器上先前备份的MBR替代服务MBR，然后使用先前备份的MBR去安装服务MBR没有安装的分区。
另一方面，计算机系统包括使用存储在辅助存储器的隐藏保护区域的服务主引导记录替代感染了病毒的当前主引导记录的装置；使用服务主引导记录将至少一个分区安装到主存储器的装置；使用先前备份的主引导记录覆盖服务主引导记录的装置；和使用先前备份的主引导记录安装使用服务主引导记录时没有安装的至少一个分区的装置。
参考附图能够最佳地理解本发明的细节，包括结构和操作，其中相似附图标记表示相似部分。
附图说明
图1是描述本发明的非限制架构的框图；和
图2是描述引导至服务分区的逻辑的非限制实施方式的流程图；
图3是描述将主引导记录(MBR)备份至例如硬盘的辅助存储器上的逻辑的非限制实施方式的流程图。
具体实施方式
首先参照图1，其显示了通常由10标记的实施了本发明的数据处理系统的高层次框图。一个非限制实施例中的系统10是个人计算机或膝上型电脑。系统10包括处理器12，可以是但不限于联想公司的PowerPC处理器(或由例如Intel或AMD制造业界常见的其它处理器)。在通电时，处理器12执行可以存储在主计算机存储器16中的例如基本输入/输出系统(BIOS)程序14的引导装入程序，将例如硬盘驱动器或闪存或其它辅助存储器的辅助数据存储器20中的主操作系统18(例如Windows XP(注册商标))装入存储器16中。如图1所示，主操作系统18可以位于辅助数据存储器20的标记为“C区”的分区中，该分区紧邻具有主引导记录(MBR)和理想的是分区引导记录(PBR)的初始扇区组21之后。MBR可以包括具有多达四个分区的空间的分区表，尽管图1为了简洁只显示了一个分区(“C”区)。
在图1所示的非限制架构中，在称为“普通”锁点22上方的是隐藏受保护区域(HPA)24，HPA 24包含根据下述逻辑获得的MBR备份和列出备份的MBR备份表，该表存储在引导器(例如BIOS)知道的位置。“普通”锁点22可以由例如系统制造者建立，系统制造者在锁点22建立SetMax指令，从而一旦发生整个系统启动，具有MBR备份的区域24就会显示为在辅助存储器20上隐藏或不存在，保护了区域24(以及图1中区域24之上的区域)不受破坏、病毒感染或任何其它会影响系统性能的伤害的影响。相应地，SetMax指令包括代表普通锁点22的位置边界的任何适当格式的数据，例如逻辑块地址(LBA)、扇区/同位标磁道组/报头等，从而当设置SetMax时，SetMax指令有效定义的普通锁点22之外的磁盘区域就会被截取，即例如当用户操作系统查询实现为HDD存储内容的存储器时，被截取的区域就不被辅助存储器列为存储器的一部分。
在MBR备份的区域24之上可以是一或多个持有增加备份的区域26，即在给定时间段内增加到原始图象上的新信息的备份。如图1所示，每个增加点可以通俗地称为“视窗阴影点”。在辅助存储器20上的最高普通备份锁点28之上可以是基础备份区域30，其保持辅助存储器20上提供的应用的原始图象、操作系统等，在基础恢复解锁点32之上可以是服务操作系统(SOS)分区34，其可保持例如Windows PE(注册商标)的SOS。如果需要，例如磁盘操作系统(DOS)信息的隐藏分区信息可以存储在SOS区域34(理想的)之上的区域36中。
理解了上述非限制架构，现在参考图2，图2显示了如果MBR扇区组21中的MBR已经被病毒破坏时能够存储在计算机介质(例如但不限于BIOS14或主存储器16)并且能够由例如BIOS实施完成引导的逻辑。从框38开始，例如中断引导流的用户接收初始扇区组21中的MBR被破坏的电位指示。用户可能中断引导的理由之一是用户可能接收到辅助存储器被破坏的计算机消息。
进行到判断菱形框40，理想的是能够确定MBR备份区域24中的备份表是否有效。可以通过比较表的散列(hash)和先前推导得到并存储的散列来实现，这将会在下文中参考图3讨论。
如果在判断菱形框40的测试失败了，返回错误并可以进行正确动作。正确动作可以是如下重建有效MBR。使用将会在下面进一步说明的图3的逻辑得到的结构，可以访问分区表中分区的开始逻辑框地址(LBA)和使用LBA访问分区。读取分区确定其是否是具有有效分区报头分区引导记录(PBR)，从而确保该分区是分区表中指示的那个。指向位置处找到的数据也能够和该分区最近备份的数据比较，如果三方都吻合，可以认为确认了正确分区开始点并且“正确的”MBR也相应地被重建。
当在判断菱形框40的测试成功时，如果MBR没有被破坏并且用户由于其它原因中断引导，在框42备份正在使用的MBR。然后，在判断菱形框44处可以确定存储在BIOS知道的服务分区34的位置的服务MBR是否有效。可以通过比较服务MBR的散列和先前得到并存储的散列从而完成该测试，这将会在下文中参考图3进行讨论。
如果服务MBR无效，返回错误，否则逻辑流至框46用服务MBR覆盖初始扇区组21中的当前MBR。然后在框48将服务O.S.从服务分区34引导至存储器16。服务MBR使得HPA的一部分看起来是标准分区，从而可以给其分配一个驱动器字母并且其可以引导普通(知晓的非HPA)操作系统。
继续到框50，使用MBR备份区域24中最近有效的MBR覆盖正在初始扇区组21中使用的服务MBR。如将参考图3进行说明的，可以在备份区域24备份数个(例如10个)MBR，在框50使用最近有效的一个。为了确定最近有效的MBR，检查MBR，首先检查最近一个的有效性，如果最近MBR无效(例如指示感染病毒的全零或其它格式)，然后检查下一个最近MBR，依此类推。
在框52结束，现在可以使用在框50处替代服务MBR的最近有效备份MBR安装任何使用服务MBR没有安装的分区。因而，现在认识到原始用户分区(例如4个)是通过迭代分区数安装的，即对每一个新的分区，更新MBR中的分区表，安装各个分区，然后更新下一分区表条目和安装其分区等，直到安装了所有的原始用户分区。
图3显示在框54处当例如用于检测分区表或MBR其它部分的变化的驱动器指示要更新载使用中的MBR(即载初始扇区组21中的MBR)时，输入DO循环。在判断菱形框56，例如通过确定变化是否包括例如指示病毒感染的全零的一或多个格式，确定变化是否是实际的。假设变化是实际的，在框58处BIOS对MBR备份区域24解锁，然后在框60处使用新的MBR覆盖备份区域最早的MBR。
进行到框62，更新由新备份的MBR指示的服务MBR中需要更新的任何分区表条目，然后计算并存储服务MBR的散列，用于如上所述的在图2中的判断菱形框44。同时，在框处64更新MBR备份区域24中的MBR表，以反映在框60的覆盖操作，然后计算并存储表格的散列，用于如上所述的在图2中的判断菱形框40。然后在框66锁住MBR备份区域24。
尽管详细描述了“在病毒攻击时引导备选MBR的系统和方法”，需要理解本发明只由权利要求限制。

Claims (21)

1.一种存储逻辑的计算机介质，其包括：
接收引导中断信号；
使用服务主引导记录覆盖当前主引导记录；
使用服务主引导记录引导服务操作系统；和
用先前备份的主引导记录替代服务主引导记录。
2.根据权利要求1所述的介质，其中逻辑进一步包括：
至少部分通过访问先前备份的主引导记录安装，安装在使用服务主引导记录时没有安装的任何分区。
3.根据权利要求1所述的介质，其中服务主引导记录和先前备份的主引导记录存储在辅助存储器中的隐藏分区区域中。
4.根据权利要求3所述的介质，其中逻辑进一步包括：
在用服务主引导记录覆盖当前主引导记录之前，备份当前主引导记录。
5.根据权利要求4所述的介质，其中只有首先确定主引导记录备份表有效时才备份当前主引导记录。
6.根据权利要求1所述的介质，其中只有首先确定服务主引导记录有效时才以服务主引导记录覆盖当前主引导记录。
7.根据权利要求1所述的介质，其中先前备份的主引导记录是多个先前备份的主引导记录之一，先前备份的主引导记录存储在辅助存储器的隐藏分区区域中。
8.根据权利要求7所述的介质，其中逻辑进一步包括：
如果当前主引导记录通过覆盖先前备份的主引导记录中最早的一个而变化时，备份当前主引导记录。
9.根据权利要求8所述的介质，其中逻辑进一步包括：
如果当前主引导记录中的分区表变化时，至少修改服务主引导记录。
10.一种计算机系统，其包括：
至少一个引导装入程序；
至少一个辅助存储器，用于至少存储用户操作系统和服务操作系统；和
至少一个主存储器，引导装入程序配置为至少部分通过访问当前主引导记录将操作系统从辅助存储器载入主存储器从而执行引导序列，引导装入程序至少部分响应于引导中断信号，使用辅助存储器中的服务主引导记录替代当前主引导记录、载入服务操作系统、使用辅助存储器上先前备份的主引导记录替代服务主引导记录、然后使用先前备份的主引导记录来安装任何没有安装的分区。
11.根据权利要求10所述的系统，其中服务主引导记录和先前备份的主引导记录存储在辅助存储器中的隐藏分区区域中。
12.根据权利要求10所述的系统，其中在用服务主引导记录覆盖当前主引导记录之前，备份当前主引导记录到辅助存储器。
13.根据权利要求12所述的系统，其中只有首先确定主引导记录备份表有效时才备份当前主引导记录。
14.根据权利要求10所述的系统，其中只有首先确定服务主引导记录有效时才以服务主引导记录覆盖当前主引导记录。
15.根据权利要求10所述的系统，其中先前备份的主引导记录是多个先前备份的主引导记录之一，先前备份的主引导记录存储在辅助存储器中。
16.根据权利要求15所述的系统，其中如果当前主引导记录通过以当前主引导记录覆盖先前备份的主引导记录中最早的一个而变化时，备份当前主引导记录。
17.根据权利要求16所述的系统，其中如果当前主引导记录中的分区表变化时，至少修改服务主引导记录。
18.一种计算机系统，其包括：
使用存储在辅助存储器的隐藏保护区域的服务主引导记录替代感染了病毒的当前主引导记录的装置；
使用服务主引导记录将至少一个分区安装到主存储器的装置；
使用先前备份的主引导记录覆盖服务主引导记录的装置；和
使用先前备份的主引导记录安装使用服务主引导记录时没有安装的至少一个分区的装置。
19.根据权利要求18所述的系统，其中只有首先确定服务主引导记录有效时才用服务主引导记录覆盖当前主引导记录。
20.根据权利要求19所述的系统，其中先前备份的主引导记录是多个先前备份的主引导记录之一，先前备份的主引导记录存储在辅助存储器中，如果当前主引导记录通过以当前主引导记录覆盖先前备份的主引导记录中最早的一个而变化时，备份当前主引导记录。
21.根据权利要求20所述的系统，其中如果当前主引导记录中的分区表变化时，至少修改服务主引导记录。
CNA2007100913058A 2006-03-29 2007-03-29 在病毒攻击时引导备选mbr的系统和方法 Pending CN101046752A (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US11/394,278 US7757112B2 (en) 2006-03-29 2006-03-29 System and method for booting alternate MBR in event of virus attack
US11/394,278 2006-03-29

Publications (1)

Publication Number Publication Date
CN101046752A true CN101046752A (zh) 2007-10-03

Family

ID=38771387

Family Applications (1)

Application Number Title Priority Date Filing Date
CNA2007100913058A Pending CN101046752A (zh) 2006-03-29 2007-03-29 在病毒攻击时引导备选mbr的系统和方法

Country Status (2)

Country Link
US (1) US7757112B2 (zh)
CN (1) CN101046752A (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100541432C (zh) * 2007-12-10 2009-09-16 上海北大方正科技电脑系统有限公司 一种电脑系统的加载方法
CN102985929A (zh) * 2010-05-11 2013-03-20 杉中顺子 外部启动设备、外部启动程序、外部启动方法及网络通信系统
WO2014044187A2 (zh) * 2012-09-18 2014-03-27 北京奇虎科技有限公司 一种检测和清除计算机病毒的方法和装置
CN103123674B (zh) * 2011-11-21 2016-12-14 研祥智能科技股份有限公司 查杀引导型病毒的方法及系统
CN106354680A (zh) * 2016-08-23 2017-01-25 北京北信源软件股份有限公司 快速识别移动存储设备的方法和装置
CN107430652A (zh) * 2015-03-19 2017-12-01 索尼公司 用于集成的可用性控制的方法和设备
CN109144779A (zh) * 2018-08-01 2019-01-04 中影环球（北京）科技有限公司 TMS服务器、Linux操作系统的备份及恢复方法

Families Citing this family (156)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8566946B1 (en) 2006-04-20 2013-10-22 Fireeye, Inc. Malware containment on connection
US8549638B2 (en) 2004-06-14 2013-10-01 Fireeye, Inc. System and method of containing computer worms
US8898788B1 (en) 2004-04-01 2014-11-25 Fireeye, Inc. Systems and methods for malware attack prevention
US8171553B2 (en) 2004-04-01 2012-05-01 Fireeye, Inc. Heuristic based capture with replay to virtual machine
US8584239B2 (en) 2004-04-01 2013-11-12 Fireeye, Inc. Virtual machine with dynamic data flow analysis
US8793787B2 (en) 2004-04-01 2014-07-29 Fireeye, Inc. Detecting malicious network content using virtual environment components
US8881282B1 (en) 2004-04-01 2014-11-04 Fireeye, Inc. Systems and methods for malware attack detection and identification
US8528086B1 (en) 2004-04-01 2013-09-03 Fireeye, Inc. System and method of detecting computer worms
US9106694B2 (en) 2004-04-01 2015-08-11 Fireeye, Inc. Electronic message analysis for malware detection
US7587537B1 (en) 2007-11-30 2009-09-08 Altera Corporation Serializer-deserializer circuits formed from input-output circuit registers
US9098448B2 (en) * 2007-05-29 2015-08-04 Dell Products L.P. Intelligent boot services
TWI342519B (en) * 2007-07-02 2011-05-21 Asustek Comp Inc Computer apparatus and starting method and module thereof
US20090172378A1 (en) * 2007-12-28 2009-07-02 Kazmierczak Gregory J Method and system for using a trusted disk drive and alternate master boot record for integrity services during the boot of a computing platform
US8997219B2 (en) 2008-11-03 2015-03-31 Fireeye, Inc. Systems and methods for detecting malicious PDF network content
US8850571B2 (en) 2008-11-03 2014-09-30 Fireeye, Inc. Systems and methods for detecting malicious network content
TWI409634B (zh) * 2008-11-28 2013-09-21 Shrisinha Technology Corp Data hiding protection method and its hardware
US8452949B1 (en) * 2009-05-28 2013-05-28 Cms Products, Inc. Optical boot to eliminate changing BIOS to boot externally attached storage device
TWI417789B (zh) * 2009-07-07 2013-12-01 Via Tech Inc 電腦系統及啟動方法
US8832829B2 (en) 2009-09-30 2014-09-09 Fireeye, Inc. Network-based binary file extraction and analysis for malware detection
TWI507985B (zh) * 2009-11-02 2015-11-11 Wistron Corp 可自動化連續安裝作業系統的電子裝置及其相關方法與系統
US8190574B2 (en) * 2010-03-02 2012-05-29 Storagecraft Technology Corporation Systems, methods, and computer-readable media for backup and restoration of computer information
CN102455921A (zh) * 2010-10-28 2012-05-16 华硕电脑股份有限公司 嵌入式系统的启动存取方法与储存装置
US8572742B1 (en) * 2011-03-16 2013-10-29 Symantec Corporation Detecting and repairing master boot record infections
US8762769B2 (en) * 2011-08-25 2014-06-24 Hewlett-Packard Development Company, L.P. Downloading a disk image from a server with a reduced corruption window
KR101994811B1 (ko) 2012-03-04 2019-07-01 삼성전자주식회사 전자 장치, ｍｂｒ 복원 방법 및 컴퓨터 판독가능 기록매체
US10572665B2 (en) 2012-12-28 2020-02-25 Fireeye, Inc. System and method to create a number of breakpoints in a virtual machine via virtual machine trapping events
US9009823B1 (en) 2013-02-23 2015-04-14 Fireeye, Inc. Framework for efficient security coverage of mobile software applications installed on mobile devices
US8990944B1 (en) 2013-02-23 2015-03-24 Fireeye, Inc. Systems and methods for automatically detecting backdoors
US9367681B1 (en) 2013-02-23 2016-06-14 Fireeye, Inc. Framework for efficient security coverage of mobile software applications using symbolic execution to reach regions of interest within an application
US9195829B1 (en) 2013-02-23 2015-11-24 Fireeye, Inc. User interface with real-time visual playback along with synchronous textual analysis log display and event/time index for anomalous behavior detection in applications
US9176843B1 (en) 2013-02-23 2015-11-03 Fireeye, Inc. Framework for efficient security coverage of mobile software applications
US9355247B1 (en) 2013-03-13 2016-05-31 Fireeye, Inc. File extraction from memory dump for malicious content analysis
US9104867B1 (en) 2013-03-13 2015-08-11 Fireeye, Inc. Malicious content analysis using simulated user interaction without user involvement
US9626509B1 (en) 2013-03-13 2017-04-18 Fireeye, Inc. Malicious content analysis with multi-version application support within single operating environment
US9311479B1 (en) 2013-03-14 2016-04-12 Fireeye, Inc. Correlation and consolidation of analytic data for holistic view of a malware attack
US9430646B1 (en) 2013-03-14 2016-08-30 Fireeye, Inc. Distributed systems and methods for automatically detecting unknown bots and botnets
US9413781B2 (en) 2013-03-15 2016-08-09 Fireeye, Inc. System and method employing structured intelligence to verify and contain threats at endpoints
US10713358B2 (en) 2013-03-15 2020-07-14 Fireeye, Inc. System and method to extract and utilize disassembly features to classify software intent
US9251343B1 (en) * 2013-03-15 2016-02-02 Fireeye, Inc. Detecting bootkits resident on compromised computers
US9495180B2 (en) 2013-05-10 2016-11-15 Fireeye, Inc. Optimized resource allocation for virtual machines within a malware content detection system
US9635039B1 (en) 2013-05-13 2017-04-25 Fireeye, Inc. Classifying sets of malicious indicators for detecting command and control communications associated with malware
US10133863B2 (en) 2013-06-24 2018-11-20 Fireeye, Inc. Zero-day discovery system
US9300686B2 (en) 2013-06-28 2016-03-29 Fireeye, Inc. System and method for detecting malicious links in electronic messages
US9411605B2 (en) * 2013-08-29 2016-08-09 Samsung Electronics Co., Ltd. Device-less and system agnostic unified extensible firmware interface (UEFI) driver
US9171160B2 (en) 2013-09-30 2015-10-27 Fireeye, Inc. Dynamically adaptive framework and method for classifying malware using intelligent static, emulation, and dynamic analyses
US10515214B1 (en) 2013-09-30 2019-12-24 Fireeye, Inc. System and method for classifying malware within content created during analysis of a specimen
US9628507B2 (en) 2013-09-30 2017-04-18 Fireeye, Inc. Advanced persistent threat (APT) detection center
US9736179B2 (en) 2013-09-30 2017-08-15 Fireeye, Inc. System, apparatus and method for using malware analysis results to drive adaptive instrumentation of virtual machines to improve exploit detection
US9690936B1 (en) 2013-09-30 2017-06-27 Fireeye, Inc. Multistage system and method for analyzing obfuscated content for malware
US9294501B2 (en) 2013-09-30 2016-03-22 Fireeye, Inc. Fuzzy hash of behavioral results
US9921978B1 (en) 2013-11-08 2018-03-20 Fireeye, Inc. System and method for enhanced security of storage devices
US9756074B2 (en) 2013-12-26 2017-09-05 Fireeye, Inc. System and method for IPS and VM-based detection of suspicious objects
US9747446B1 (en) 2013-12-26 2017-08-29 Fireeye, Inc. System and method for run-time object classification
US9740857B2 (en) 2014-01-16 2017-08-22 Fireeye, Inc. Threat-aware microvisor
US9262635B2 (en) 2014-02-05 2016-02-16 Fireeye, Inc. Detection efficacy of virtual machine-based analysis with application specific events
US9241010B1 (en) 2014-03-20 2016-01-19 Fireeye, Inc. System and method for network behavior detection
US10242185B1 (en) 2014-03-21 2019-03-26 Fireeye, Inc. Dynamic guest image creation and rollback
US9591015B1 (en) 2014-03-28 2017-03-07 Fireeye, Inc. System and method for offloading packet processing and static analysis operations
US9432389B1 (en) 2014-03-31 2016-08-30 Fireeye, Inc. System, apparatus and method for detecting a malicious attack based on static analysis of a multi-flow object
US9223972B1 (en) 2014-03-31 2015-12-29 Fireeye, Inc. Dynamically remote tuning of a malware content detection system
US9438623B1 (en) 2014-06-06 2016-09-06 Fireeye, Inc. Computer exploit detection using heap spray pattern matching
US9594912B1 (en) 2014-06-06 2017-03-14 Fireeye, Inc. Return-oriented programming detection
US9973531B1 (en) 2014-06-06 2018-05-15 Fireeye, Inc. Shellcode detection
US10084813B2 (en) 2014-06-24 2018-09-25 Fireeye, Inc. Intrusion prevention and remedy system
US9398028B1 (en) 2014-06-26 2016-07-19 Fireeye, Inc. System, device and method for detecting a malicious attack based on communcations between remotely hosted virtual machines and malicious web servers
US10805340B1 (en) 2014-06-26 2020-10-13 Fireeye, Inc. Infection vector and malware tracking with an interactive user display
US10002252B2 (en) 2014-07-01 2018-06-19 Fireeye, Inc. Verification of trusted threat-aware microvisor
US9363280B1 (en) 2014-08-22 2016-06-07 Fireeye, Inc. System and method of detecting delivery of malware using cross-customer data
US10671726B1 (en) 2014-09-22 2020-06-02 Fireeye Inc. System and method for malware analysis using thread-level event monitoring
US9773112B1 (en) 2014-09-29 2017-09-26 Fireeye, Inc. Exploit detection of malware and malware families
US10027689B1 (en) 2014-09-29 2018-07-17 Fireeye, Inc. Interactive infection visualization for improved exploit detection and signature generation for malware and malware families
US9690933B1 (en) 2014-12-22 2017-06-27 Fireeye, Inc. Framework for classifying an object as malicious with machine learning for deploying updated predictive models
US10075455B2 (en) 2014-12-26 2018-09-11 Fireeye, Inc. Zero-day rotating guest image profile
US9934376B1 (en) 2014-12-29 2018-04-03 Fireeye, Inc. Malware detection appliance architecture
US9838417B1 (en) 2014-12-30 2017-12-05 Fireeye, Inc. Intelligent context aware user interaction for malware detection
US20160232057A1 (en) * 2015-02-11 2016-08-11 Sandisk Technologies Inc. Safe mode boot loader
US10148693B2 (en) 2015-03-25 2018-12-04 Fireeye, Inc. Exploit detection system
US9690606B1 (en) 2015-03-25 2017-06-27 Fireeye, Inc. Selective system call monitoring
US9438613B1 (en) 2015-03-30 2016-09-06 Fireeye, Inc. Dynamic content activation for automated analysis of embedded objects
US10474813B1 (en) 2015-03-31 2019-11-12 Fireeye, Inc. Code injection technique for remediation at an endpoint of a network
US10417031B2 (en) 2015-03-31 2019-09-17 Fireeye, Inc. Selective virtualization for security threat detection
US9483644B1 (en) 2015-03-31 2016-11-01 Fireeye, Inc. Methods for detecting file altering malware in VM based analysis
US9654485B1 (en) 2015-04-13 2017-05-16 Fireeye, Inc. Analytics-based security monitoring system and method
US9594904B1 (en) 2015-04-23 2017-03-14 Fireeye, Inc. Detecting malware based on reflection
US10642753B1 (en) 2015-06-30 2020-05-05 Fireeye, Inc. System and method for protecting a software component running in virtual machine using a virtualization layer
JP6249995B2 (ja) * 2015-06-30 2017-12-20 キヤノン株式会社 情報処理装置、情報処理システム、情報処理装置の制御方法、及び、プログラム
US10454950B1 (en) 2015-06-30 2019-10-22 Fireeye, Inc. Centralized aggregation technique for detecting lateral movement of stealthy cyber-attacks
US10726127B1 (en) 2015-06-30 2020-07-28 Fireeye, Inc. System and method for protecting a software component running in a virtual machine through virtual interrupts by the virtualization layer
US11113086B1 (en) 2015-06-30 2021-09-07 Fireeye, Inc. Virtual system and method for securing external network connectivity
US10715542B1 (en) 2015-08-14 2020-07-14 Fireeye, Inc. Mobile application risk analysis
US10176321B2 (en) 2015-09-22 2019-01-08 Fireeye, Inc. Leveraging behavior-based rules for malware family classification
US10033747B1 (en) 2015-09-29 2018-07-24 Fireeye, Inc. System and method for detecting interpreter-based exploit attacks
US10210329B1 (en) 2015-09-30 2019-02-19 Fireeye, Inc. Method to detect application execution hijacking using memory protection
US10601865B1 (en) 2015-09-30 2020-03-24 Fireeye, Inc. Detection of credential spearphishing attacks using email analysis
US9825976B1 (en) 2015-09-30 2017-11-21 Fireeye, Inc. Detection and classification of exploit kits
US10817606B1 (en) 2015-09-30 2020-10-27 Fireeye, Inc. Detecting delayed activation malware using a run-time monitoring agent and time-dilation logic
US10706149B1 (en) 2015-09-30 2020-07-07 Fireeye, Inc. Detecting delayed activation malware using a primary controller and plural time controllers
US9825989B1 (en) 2015-09-30 2017-11-21 Fireeye, Inc. Cyber attack early warning system
US10284575B2 (en) 2015-11-10 2019-05-07 Fireeye, Inc. Launcher for setting analysis environment variations for malware detection
US10447728B1 (en) 2015-12-10 2019-10-15 Fireeye, Inc. Technique for protecting guest processes using a layered virtualization architecture
US10846117B1 (en) 2015-12-10 2020-11-24 Fireeye, Inc. Technique for establishing secure communication between host and guest processes of a virtualization architecture
US10108446B1 (en) 2015-12-11 2018-10-23 Fireeye, Inc. Late load technique for deploying a virtualization layer underneath a running operating system
US10050998B1 (en) 2015-12-30 2018-08-14 Fireeye, Inc. Malicious message analysis system
US10565378B1 (en) 2015-12-30 2020-02-18 Fireeye, Inc. Exploit of privilege detection framework
US10133866B1 (en) 2015-12-30 2018-11-20 Fireeye, Inc. System and method for triggering analysis of an object for malware in response to modification of that object
US10621338B1 (en) 2015-12-30 2020-04-14 Fireeye, Inc. Method to detect forgery and exploits using last branch recording registers
US11552986B1 (en) 2015-12-31 2023-01-10 Fireeye Security Holdings Us Llc Cyber-security framework for application of virtual features
US10581874B1 (en) 2015-12-31 2020-03-03 Fireeye, Inc. Malware detection system with contextual analysis
US9824216B1 (en) 2015-12-31 2017-11-21 Fireeye, Inc. Susceptible environment detection system
US10671721B1 (en) 2016-03-25 2020-06-02 Fireeye, Inc. Timeout management services
US10601863B1 (en) 2016-03-25 2020-03-24 Fireeye, Inc. System and method for managing sensor enrollment
US10785255B1 (en) 2016-03-25 2020-09-22 Fireeye, Inc. Cluster configuration within a scalable malware detection system
US10616266B1 (en) 2016-03-25 2020-04-07 Fireeye, Inc. Distributed malware detection system and submission workflow thereof
US10826933B1 (en) 2016-03-31 2020-11-03 Fireeye, Inc. Technique for verifying exploit/malware at malware detection appliance through correlation with endpoints
US10893059B1 (en) 2016-03-31 2021-01-12 Fireeye, Inc. Verification and enhancement using detection systems located at the network periphery and endpoint devices
US10169585B1 (en) 2016-06-22 2019-01-01 Fireeye, Inc. System and methods for advanced malware detection through placement of transition events
US10462173B1 (en) 2016-06-30 2019-10-29 Fireeye, Inc. Malware detection verification and enhancement by coordinating endpoint and malware detection systems
US10592678B1 (en) 2016-09-09 2020-03-17 Fireeye, Inc. Secure communications between peers using a verified virtual trusted platform module
US10491627B1 (en) 2016-09-29 2019-11-26 Fireeye, Inc. Advanced malware detection using similarity analysis
US10795991B1 (en) 2016-11-08 2020-10-06 Fireeye, Inc. Enterprise search
US10587647B1 (en) 2016-11-22 2020-03-10 Fireeye, Inc. Technique for malware detection capability comparison of network security devices
US10581879B1 (en) 2016-12-22 2020-03-03 Fireeye, Inc. Enhanced malware detection for generated objects
US10552610B1 (en) 2016-12-22 2020-02-04 Fireeye, Inc. Adaptive virtual machine snapshot update framework for malware behavioral analysis
US10523609B1 (en) 2016-12-27 2019-12-31 Fireeye, Inc. Multi-vector malware detection and analysis
US10904286B1 (en) 2017-03-24 2021-01-26 Fireeye, Inc. Detection of phishing attacks using similarity analysis
US10791138B1 (en) 2017-03-30 2020-09-29 Fireeye, Inc. Subscription-based malware detection
US10798112B2 (en) 2017-03-30 2020-10-06 Fireeye, Inc. Attribute-controlled malware detection
US10554507B1 (en) 2017-03-30 2020-02-04 Fireeye, Inc. Multi-level control for enhanced resource and object evaluation management of malware detection system
US10902119B1 (en) 2017-03-30 2021-01-26 Fireeye, Inc. Data extraction system for malware analysis
US10601848B1 (en) 2017-06-29 2020-03-24 Fireeye, Inc. Cyber-security system and method for weak indicator detection and correlation to generate strong indicators
US10503904B1 (en) 2017-06-29 2019-12-10 Fireeye, Inc. Ransomware detection and mitigation
US10855700B1 (en) 2017-06-29 2020-12-01 Fireeye, Inc. Post-intrusion detection of cyber-attacks during lateral movement within networks
US10893068B1 (en) 2017-06-30 2021-01-12 Fireeye, Inc. Ransomware file modification prevention technique
US10747872B1 (en) 2017-09-27 2020-08-18 Fireeye, Inc. System and method for preventing malware evasion
US10805346B2 (en) 2017-10-01 2020-10-13 Fireeye, Inc. Phishing attack detection
US11108809B2 (en) 2017-10-27 2021-08-31 Fireeye, Inc. System and method for analyzing binary code for malware classification using artificial neural network techniques
US11271955B2 (en) 2017-12-28 2022-03-08 Fireeye Security Holdings Us Llc Platform and method for retroactive reclassification employing a cybersecurity-based global data store
US11240275B1 (en) 2017-12-28 2022-02-01 Fireeye Security Holdings Us Llc Platform and method for performing cybersecurity analyses employing an intelligence hub with a modular architecture
US11005860B1 (en) 2017-12-28 2021-05-11 Fireeye, Inc. Method and system for efficient cybersecurity analysis of endpoint events
US10826931B1 (en) 2018-03-29 2020-11-03 Fireeye, Inc. System and method for predicting and mitigating cybersecurity system misconfigurations
US11003773B1 (en) 2018-03-30 2021-05-11 Fireeye, Inc. System and method for automatically generating malware detection rule recommendations
US10956477B1 (en) 2018-03-30 2021-03-23 Fireeye, Inc. System and method for detecting malicious scripts through natural language processing modeling
US11558401B1 (en) 2018-03-30 2023-01-17 Fireeye Security Holdings Us Llc Multi-vector malware detection data sharing system for improved detection
JP7179482B2 (ja) * 2018-04-19 2022-11-29 キヤノン株式会社 情報処理装置、制御方法、およびそのプログラム
US11075930B1 (en) 2018-06-27 2021-07-27 Fireeye, Inc. System and method for detecting repetitive cybersecurity attacks constituting an email campaign
US11314859B1 (en) 2018-06-27 2022-04-26 FireEye Security Holdings, Inc. Cyber-security system and method for detecting escalation of privileges within an access token
US11228491B1 (en) 2018-06-28 2022-01-18 Fireeye Security Holdings Us Llc System and method for distributed cluster configuration monitoring and management
US11316900B1 (en) 2018-06-29 2022-04-26 FireEye Security Holdings Inc. System and method for automatically prioritizing rules for cyber-threat detection and mitigation
US11182473B1 (en) 2018-09-13 2021-11-23 Fireeye Security Holdings Us Llc System and method for mitigating cyberattacks against processor operability by a guest process
US11763004B1 (en) 2018-09-27 2023-09-19 Fireeye Security Holdings Us Llc System and method for bootkit detection
US11368475B1 (en) 2018-12-21 2022-06-21 Fireeye Security Holdings Us Llc System and method for scanning remote services to locate stored objects with malware
US11258806B1 (en) 2019-06-24 2022-02-22 Mandiant, Inc. System and method for automatically associating cybersecurity intelligence to cyberthreat actors
US11556640B1 (en) 2019-06-27 2023-01-17 Mandiant, Inc. Systems and methods for automated cybersecurity analysis of extracted binary string sets
US11392700B1 (en) 2019-06-28 2022-07-19 Fireeye Security Holdings Us Llc System and method for supporting cross-platform data verification
US11886585B1 (en) 2019-09-27 2024-01-30 Musarubra Us Llc System and method for identifying and mitigating cyberattacks through malicious position-independent code execution
US11637862B1 (en) 2019-09-30 2023-04-25 Mandiant, Inc. System and method for surfacing cyber-security threats with a self-learning recommendation engine

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5418918A (en) * 1993-09-10 1995-05-23 Compaq Computer Corp. Scanning initial CD-ROM sectors for a boot record and executing said boot record to load and execute floppy disk image corresponding to the existing floppy drive
US5509120A (en) * 1993-11-30 1996-04-16 International Business Machines Corporation Method and system for detecting computer viruses during power on self test
US5701477A (en) * 1995-03-30 1997-12-23 Cirrus Logic, Inc. Method and apparatus for master boot record shadowing
US6802028B1 (en) * 1996-11-11 2004-10-05 Powerquest Corporation Computer virus detection and removal
US6560701B1 (en) * 1997-02-10 2003-05-06 International Business Machines Corporation Alternate boot record
US5974567A (en) * 1997-06-20 1999-10-26 Compaq Computer Corporation Ghost partition
US6205558B1 (en) * 1998-10-07 2001-03-20 Symantec Corporation Recovery of file systems after modification failure
US6415382B1 (en) * 1999-04-30 2002-07-02 Adaptec, Inc. Hard disk bootstrap redirection
US6665778B1 (en) * 1999-09-23 2003-12-16 Gateway, Inc. System and method for storage of device performance data
US6792556B1 (en) * 2000-05-31 2004-09-14 Dell Products L.P. Boot record recovery
US6963951B2 (en) * 2000-07-12 2005-11-08 Seagate Technology Llc Partition recovery method
US20020166059A1 (en) * 2001-05-01 2002-11-07 Rickey Albert E. Methods and apparatus for protecting against viruses on partitionable media
US6862681B2 (en) * 2001-07-16 2005-03-01 International Business Machines Corporation Method and system for master boot record recovery
US7024581B1 (en) * 2002-10-09 2006-04-04 Xpoint Technologies, Inc. Data processing recovery system and method spanning multiple operating system
US7194659B2 (en) * 2002-12-10 2007-03-20 International Business Machines Corporation Method and system for detection and correction of entrance into an improper MBR state in a computer system
CN1277211C (zh) * 2003-05-06 2006-09-27 联想(北京)有限公司 一种计算机操作系统的修复方法
US20040255106A1 (en) * 2003-06-10 2004-12-16 Rothman Michael A. Recovery of operating system configuration data by firmware of computer system
US7219257B1 (en) * 2003-06-27 2007-05-15 Adaptec, Inc. Method for boot recovery
KR101115486B1 (ko) * 2003-08-08 2012-02-27 엘지전자 주식회사 컴퓨터 시스템의 부팅 제어 장치 및 방법
TW200508971A (en) * 2003-08-28 2005-03-01 Wistron Corp Computer boot method and related computer
US20060041738A1 (en) * 2004-08-17 2006-02-23 Yu-Chen Lai Recovery method for master boot record of hard disk drive

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100541432C (zh) * 2007-12-10 2009-09-16 上海北大方正科技电脑系统有限公司 一种电脑系统的加载方法
CN102985929A (zh) * 2010-05-11 2013-03-20 杉中顺子 外部启动设备、外部启动程序、外部启动方法及网络通信系统
CN103123674B (zh) * 2011-11-21 2016-12-14 研祥智能科技股份有限公司 查杀引导型病毒的方法及系统
WO2014044187A2 (zh) * 2012-09-18 2014-03-27 北京奇虎科技有限公司 一种检测和清除计算机病毒的方法和装置
WO2014044187A3 (zh) * 2012-09-18 2014-05-22 北京奇虎科技有限公司 一种检测和清除计算机病毒的方法和装置
CN107430652A (zh) * 2015-03-19 2017-12-01 索尼公司 用于集成的可用性控制的方法和设备
CN106354680A (zh) * 2016-08-23 2017-01-25 北京北信源软件股份有限公司 快速识别移动存储设备的方法和装置
CN106354680B (zh) * 2016-08-23 2019-01-18 北京北信源软件股份有限公司 快速识别移动存储设备的方法和装置
CN109144779A (zh) * 2018-08-01 2019-01-04 中影环球（北京）科技有限公司 TMS服务器、Linux操作系统的备份及恢复方法

Also Published As

Publication number Publication date
US7757112B2 (en) 2010-07-13
US20080046781A1 (en) 2008-02-21

Similar Documents

Publication Publication Date Title
CN101046752A (zh) 在病毒攻击时引导备选mbr的系统和方法
US6948165B1 (en) Method for installing an application program, to be executed during each bootload of a computer system for presenting a user with content options prior to conventional system startup presentation, without requiring a user's participation to install the program
CN1029336C (zh) 保护个人计算机中系统应用程序的装置
US7032107B2 (en) Virtual partition for recording and restoring computer data files
US6691213B1 (en) Computer system and method for accessing a protected partition of a disk drive that lies beyond a limited address range of a host computer's BIOS
US7765395B2 (en) Operating system rebooting method and apparatus for continuing to execute a non-stop module even during rebooting
US7624243B2 (en) Apparatus and method for protecting system data on computer hard-disk
US20080091874A1 (en) System and method for loading programs from hdd independent of operating system
CN100573480C (zh) 一种磁盘数据保护方法和系统
US7469261B2 (en) Apparatus and method for protecting system data on computer hard-disk
CN100369000C (zh) 一种计算机硬盘数据多时间点快速存储与恢复方法
CN101373457B (zh) Windows环境下一种基于USB设备的硬盘写保护锁的方法
US20060080518A1 (en) Method for securing computers from malicious code attacks
WO2008135969A1 (en) Storage device and method for data-smuggling
CN101236533B (zh) Windows环境下一种基于PCI卡实现硬盘写保护锁的方法
CN100547550C (zh) 安装和载入用户操作系统后安装系统管理程序的系统和方法
US7024493B1 (en) Bootable CD for transferring files independently of computer operating systems
CN106547589A (zh) 一种升级系统以及升级方法
KR100950936B1 (ko) 다수의 드라이브가 구현될 수 있는 솔리드 스테이트드라이브
US20220147343A1 (en) Tranistionary firmware packages
CN101004692A (zh) 一种软件安装的虚拟执行方法及系统
WO2021161418A1 (ja) 情報処理装置、情報処理方法及び情報処理プログラム
US20040141246A1 (en) Hard disk drive host protected area duplication
KR101282443B1 (ko) 데이터 백업 및 복원 방법
JPH0744428A (ja) 外部記憶装置の処理方法

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C12 Rejection of a patent application after its publication
RJ01 Rejection of invention patent application after publication

Open date: 20071003