Security method and apparatus directed at removable storage devices

摘要

A method of protecting a computer against malware infection. The method includes during operation of the computer, reading master boot record code from a removable storage device into the computer and inspecting said code to identify any instructions associated with suspicious behaviour. In the event that suspicious instructions are identified, the master boot record code on the removable storage device is modified and/or the behaviour of the computer adapted in order to prevent said master boot record code installing malware into the computer. Examples of suspicious behaviour include hard disk read or write operations.

主权项

1. A method of protecting a computer against malware infection, the method comprising:
running an anti-virus application on the computer after the computer has booted from a local hard drive into an operating system; informing the booted up operating system of the computer of an occurrence of a mounting of a removable storage device by providing an interrupt to the operating system and passing this interrupt to the anti-virus application and, in response, the anti-virus application reading master boot record code from a first sector of the removable storage device into the computer; inspecting by the anti-virus application said master boot record code to identify any instructions requiring reading or writing to the local hard drive; and when instructions requiring reading or writing to the local hard drive are identified by the anti-virus application based upon the inspecting, modifying by the anti-virus application the master boot record code on the removable storage device or adapting behaviour of the computer in order to prevent said master boot record code installing malware into the computer and allowing use of the removable storage device.