Trusted operating environment for malware detection

摘要

Described herein are techniques and apparatuses for scanning a computing device for malware and/or viruses. In various embodiments, a trusted operating environment, which may include a trusted operating system and/or a trusted antivirus tool, may be utilized with respect to a computing device. More particularly, the trusted operating system may be used to boot the computing device. Moreover, the trusted antivirus tool may search the computing device for malware definition updates (e.g., virus signature updates) and use the trusted operating system to scan the computing device for malware. In other embodiments, the trusted antivirus tool may scan the computing device and remove any viruses detected by the trusted antivirus tool. The trusted operating system may then reboot the computing device into a clean environment once any detected viruses are removed.

主权项

1. A method comprising:
booting a computing device with a trusted operating system residing on a server device located remotely from the computing device; running, from the server device, an antivirus tool that resides on the server device; authenticating one or more virus signature updates by comparing one or more digital signatures associated with the one or more virus signature updates to one or more root certificates; scanning, with the antivirus tool that resides on the server device, the computing device to identify any viruses residing in the computing device using authenticated virus signature updates; and removing the viruses detected by the antivirus tool based at least in part on the authenticated virus signature updates.