METHOD AND SYSTEM FOR REMOVING MALICIOUS SOFTWARE WHICH INHIBIT TREATMENT Russian patent published in 2009 - IPC G06F21/22 

FIELD: information technology.

SUBSTANCE: invention relates to antivirus methods and, more specifically, to treatment of computers from malicious software which inhibit treatment. The system, method and machine-readable medium for removing malicious software from a computer, with several copies of the same activated malicious software, where several copies control presence of others, include (a) detection of presence malicious software on a computer; (b) blocking any actions, which allow one activated copy of malicious software to activate another copy; (c) removal from read-only memory of a file containing executable code of the malicious software; and (d) rebooting the computer. Actions include prevention of recording on read-only memory, prevention of recording in the registry and/or blocking activation of new processes. Blocking uses a driver, loaded in the kernel area. Signature identification can be used for detecting malicious software.

EFFECT: removal of malicious software which inhibit treatment.

12 cl, 11 dwg