SYSTEM AND METHOD FOR NEUTRALIZING PESTWARE THAT IS LOADED BY A DESIRABLE PROCESS

摘要

Systems and methods for managing pestware on a protected computer are described. In one implementation, a pestware construct is identified. Threads loaded by the pestware construct into a desirable process are identified and suspended. Neutralization of the pestware construct is accomplished by preventing code underlying pestware functions exported by the pestware construct from executing. In variations of the invention, registry entries associate with the pestware construct are detected and deleted, and the pestware construct is scheduled for deletion after the next reboot of a protected computer.